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Advanced Micro Devices’ microprocessors are breaking performance barriers. The 
cost effective Am386 microprocessors are ideal for both desktop and battery pow- 
ered portable computers. This data book describes the 32-bit Am386 Microprocessor 
Family with data sheets on Am386DX/DXL and Am386SX/SXL microprocessors. 


Am386 microprocessors are the fastest available with 40 MHz on the Am3886DXL 
microprocessor, a 21% performance increase over the 33-MHz version; and 25 MHz 
on the Am386SXL microprocessor, a 25% performance increase over the 20-MHz 
version. For portable systems the Am386DXL/SXL microprocessors’ true static 
design allows longer battery life by offering low operating power consumption anda 
standby mode. 


We also offer 3-V Am386 microprocessors optimized for notebook applications. 
Information on these can be found in the AMD® 3-Volt System Logic for Personal 
Computers Data Book, publication #17028. 


Remember, our partnership helps you gain and keep the competitive edge. We are 
not your competition. 


Robert G. McConnell 


Vice President 
Personal Computer Products Division 





introduction 


eee cr 


Am386"™DX/DXL 


High-Performance, Low-Power, 32-Bit Microprocessor 


DISTINCTIVE CHARACTERISTICS 
H Ideal for portable PCs 


—True static design for long battery life 
(Am386DXL microprocessor) 


—Typical standby Icc<20 WA at DC (0 MHz) 
(Am386DXL microprocessor) 


—Typical operating lcc=210 mA at 33 MHz 


—Lower power consumption than Intel i3886DX or 
Intel i886SX 


—Small footprint 132-pin PQFP package 


—Wide range of chip sets and BIOS available to 
support standby mode capabilities 


GENERAL DESCRIPTION 


The Am386DX/DXL microprocessor is a high-speed, 
true static implementation of the Intel i886DX micropro- 
cessor. It is ideal for both desktop and battery-powered 
portable personal computers. For desktop PCs, the 
Am386DXL microprocessor offers a 21% increase in 
the maximum operating speed from 33 to 40 MHz. Also, 
this device offers lower heat dissipation, allowing sys- 
tem designers to remove or reduce the size and cost of 
the system cooling fan. 


For portables, the Am386DXL microprocessor’s true 


Static design offers longer battery life with low operating 
power consumption and standby mode. At 33 MHz, this 
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—Performance on demand (0 to 40 MHz) 
H ideal for desktop PCs 
—40-, 33-, 25-, and 20-MHz operating speeds 


—Lower heat dissipation facilitates fan reduction or 
elimination for cost savings and noise reduction 


—Pin-for-pin replacement for Intel iS86DX 
— Compatible with 386DX systems and software 


— Supports 387DX-compatible math 
coprocessors 


M AMD advanced 0.8 micron CMOS technology 


device has 40% lower operating Icc than the Intel 
i386DX. Standby mode allows the Am386DXL micro- 
processor to be clocked down to 0 MHz (DC) and retain 
full register contents. In standby mode, typical current 
draw is less than 20 vA, nearly a 1000x reduction in 
power consumption versus the Intel i386DX or Intel 
iS86SX. 


Additionally, the Am3886DXL microprocessor is avail- 
able in a small footprint 132-pin plastic quad flat pack 
(PQFP) package. This surface-mount package is 40% 
smaller than PGA, allowing smaller, lower-cost board 
designs without the need for a socket. 





Typical Icc 
250 
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FUNCTIONAL DESCRIPTION 


True Static Operation (Am386DXL CPU) 


The Am386DXL microprocessor incorporates a true 
static design. Unlike dynamic circuit design, the 
Am386DXL device eliminates the minimum operating 
frequency restriction. It may be clocked from its maxi- 
mum speed of 40 MHz all the way down to 0 MHz (DC). 
System designers can use this feature to design true 
32-bit battery-powered portable PCs with long battery 
life. 


Standby Mode (Am386DXL CPU) 


This true static design allows for a standby mode. At any 
of its operating speeds (40 MHz to DC), the AmM386DXL 
microprocessor will retain its state (i.e., the contents of 
all of its registers). By shutting off the clock completely, 
the device enters standby mode. Since power con- 
sumption is a function of clock frequency, operating 
power consumption is reduced as the frequency is low- 
ered. In standby mode, typical current draw is reduced 
to less than 20 pA at DC. 


Not only does this feature save battery life, but it also 


simplifies the design of power-conscious notebook 
computers in the following ways: 


1. Eliminates the need for software in BIOS to save 
and restore the contents of registers. 


2. Allows simpler circuitry to control stopping of the 
clock since the system does not need to know 
the processor state. 
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Lower Operating lIcc 


True static design also allows lower operating Icc when 
Operating at any speed. See the following graph for typi- 
cal current at operating speeds. 


Performance On Demand 


The Am386DXL microprocessor retains its state at any 
speed from 0 MHz (DC) to its maximum operating speed 
(20, 25, 33, or 40 MHz). With this feature, system de- 
signers may vary the operating speed of the system to 
extend the battery life in portable systems. 


For example, the system could operate at low speeds 
during inactivity or polling operations. However, upon in- 
terrupt, the system clock can be increased up to its 
maximum speed. After a user-defined time-out period, 
the system can be returned to a low (or 0 MHz) operating 
speed without losing its state. This design maximizes 
life while achieving optimal performance. 
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CONNECTION DIAGRAMS 
132-Lead Ceramic Pin Grid Array (PGA) Package — Top Side View 
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Note: NC = Not connected; connection of any NC pin may cause a malfunction or incompatability with future 
shippings of the Am386DX/DXL microprocessor. 
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132-Lead Ceramic Pin Grid Array (PGA) Package — Pin Side View 


CONNECTION DIAGRAMS (continued) 
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; connection of any NC pin may cause a malfunction or incompatability with future 
Am386DX/DXL Microprocessor Data Sheet 


shippings of the Am386DX/DXL microprocessor. 


Note: NC = Not connected 
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CONNECTION DIAGRAMS (continued) 

PGA Pin Designations (sorted by Functional Grouping) 

| Address | Data Control PNG 
A4 


Pin Pin Pin Pin Pin Pin 
Name No. Name No. Name No. 


Pec | es 
Al A2 | 
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CONNECTION DIAGRAMS (continued) 
PGA Pin Designations (sorted by Pin Number) 


Pin Pin Pin Pin Pin Pin Pin Pin Pin 
No. Name No. Name No. Name No. Name No. 
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Pin Pin Pin 
Name No. Name 
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CONNECTION DIAGRAMS (continued) 
132-Lead Plastic Quad Flat Pack (PQFP) Package — Top Side View 
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Notes: Pin 1 is marked for orientation. 
NC = Not connected; connection of an NC pin may cause a malfunction or incompatibility with future 
shippings of the Am386DX/DXL microprocessor. 
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CONNECTION DIAGRAMS (continued) 
132-Lead Plastic Quad Flat Pack (PQFP) Package — Pin Side View 
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Notes: Pin 1 is marked for orientation. 
NC = Not connected; connection of an NC pin may cause a malfunction or incompatibility with future 
shippings of the Am386DX/DXL microprocessor. 
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CONNECTION DIAGRAMS (continued) 
PQFP Pin Designations (sorted by Functional Grouping) 
[Address | Data 


Pin Pin Pin Pin 
Name No. Name No. 
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CONNECTION DIAGRAMS (continued) 
PQFP Pin Designations (sorted by Pin Number) 


Pin Pin Pin Pin Pin Pin Pin Pin Pin Pin Pin Pin 
No. Name No. Name No. Name No. Name No. Name No. Name 
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LOGIC SYMBOL 
2X Clock 22> Data Bus 
Address 
Bus Float 
Interrupt 
Control 
Bus 
Cycle 
Control 
Math 
Coprocessor 
Control 
Bus 
Cycle 
Definition 


HLDA 





Bus Arbitration . 


Control 15021B-003 
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ORDERING INFORMATION 
Standard Products 


AMD standard products are available in several packages and operating ranges. The order number (Valid Combination) is 
formed by a combination of the elements below. 


A 80386DXL —33 


[ 


OPTIONAL PROCESSING (PQFP Only) 


None = Trimmed and Formed PQFP in High Temp Trays 
/F = Ringed PQFP in Horizontal Tubes 


TEMPERATURE RANGE 


Blank = Commercial (Tcase = 0°C to +85°C for PGA) 
(Tcase = 0°C to +100°C for PQFP) 


SPEED OPTION 


—40 = 40 MHz 
-—33 =33 MHz 
—25 = 25 MHz 
~—20 =20 MHz 


DEVICE NUMBER/DESCRIPTION 


80386DX/DXL 
Am386DX/DXL High-Performance, Low-Power, 32-Bit Microprocessor 


PACKAGE TYPE 


A = 132-Lead Ceramic Pin Grid Array (CGX 132) 
NG = 132-Lead Plastic Quad Flat Pack (PQB 132) 


Valid Combinations 


A80386DX/DXL 


NG80386DX —40, —40/F 


NG80386DX/DXL 






Valid Combinations 


Valid Combinations lists configurations planned to 
be supported in volume for this device. All speeds 
may not be available in all package combinations. 
Consult the local AMD sales office to confirm 
availability of specific valid combinations and to 
check on newly released combinations. 









—33, —33/F 
—25, —25/F 
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PIN DESCRIPTION 

A31—A2 

Address Bus (Outputs) 

Outputs physical memory or port I/O addresses. 


ADS 
Address Status (Active Low; Output) 
Indicates that a valid bus cycle definition and address 


are being driven at the Am386DX/DXL microprocessor 
pins. 

BE3—BEO 

Byte Enables (Active Low; Outputs) 

Indicate which data bytes of the data bus take part ina 
bus cycle. 

BS16 

Bus Size 16 (Active Low; Input) 

Allows direct connection of 32-bit and 16-bit data buses. 


BUSY 
Busy (Active Low; input) 
Signals a busy condition from a processor extension. 


CLK2 

Clock (Input) 

Provides the fundamental timing for the Am386DX/DXL 
microprocessor. 

D31—D0 

Data Bus (Inputs/Outputs) 

Inputs data during memory, I/O, and interrupt acknow- 
ledge read cycles and outputs data during memory and 
I/O write cycles. 

D/c 

Data/Control (Output) 

Abus cycie definition pin that distinguishes data cycles, 
either memory or I/O, from control cycles which are: 
interrupt acknowledge, halt, and instruction fetching. 
ERROR 

Error (Active Low; Input) 

Signals an error condition from a processor extension. 
FELT 

Float (Active Low; Input) 


An input signal which forces all bidirectional and output 
signals, including HLDA, to the three-state condition. 


FLT has an internal pull-up resistor, and if it is not used it 
should be unconnected. 

HLDA 

Bus Hold Acknowledge (Active High; Output) 
Indicates that the Am386DX/DXL microprocessor has 
surrendered control of its local bus to another bus 
master. 

HOLD 

Bus Hold Request (Active High; Input) 


Allows another bus master to request control of the local 
bus. 


INTR 

interrupt Request (Active High; Input) 

A maskable input that signals the Am386DX/DXL micro- 
processor to suspend execution of the current program 
and execute an interrupt acknowledge function. 

LOCK 

Bus Lock (Active Low; Output) 

A bus cycle definition pin that indicates that other sys- 
tem bus masters are denied access to the system bus 
while it is active. 

Mio 

Memory I/O (Output) 

A bus cycle definition pin that distinguishes memory 
cycles from input/output cycles. 

NA 

Next Address (Active Low; Input) 

Used to request address pipelining. 


NC 

No Connect 

Should always remain unconnected. Connection of a 
NC pin may cause the processor to malfunction or be 
incompatible with future steppings of the Am386DX/ 
DXL microprocessor. 

NMI 

Non-Maskable Interrupt Request 

(Active High; Input) 

A non-maskable input that signals the Am386DX/DXL 
microprocessor to suspend execution of the current pro- 
gram and execute an interrupt acknowledge function. 
PEREQ 

Processor Extension Request (Active High; Input) 
indicates that the processor extension has data to be 
transferred by the Am386DX/DXL microprocessor. 
READY 

Bus Ready (Active Low; Input) 

Terminates the bus cycle. 


RESET 

Reset (Active High; Input) 

Suspends any operation in progress and places the 
Am386DX/DXL microprocessor in a known reset state. 
Vcc 

System Power (Input) 

Provides the +5-V nominal DC supply input. 


Vss 

System Ground (Input) 

Provides 0-V connection from which all inputs and out- 
puts are measured. 

W/R 

Write/Read (Output) 


Abus cycle definition pin that distinguishes write cycles 
from read cycles. 
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BASE ARCHITECTURE 


Introduction 


The Am386DX/DXL microprocessor consists of a 
central processing unit, a memory management unit, 
and a bus interface. 


The central processing unit consists of the execution 
unit and instruction unit. The execution unit contains 
the eight 32-bit general purpose registers that are used 
for both address calculation, data operations, and a 
64-bit barrel shifter used to speed shift, rotate, multiply, 
and divide operations. The multiply and divide logic 
uses a 1-bit per cycle algorithm. The multiply algorithm 
stops the iteration when the most significant bits of 
the multiplier are all zero. This allows typical 32-bit 
multiplies to be executed in under 1 ms. The instruction 
unit decodes the instruction op-codes and stores them 
in the decoded instruction queue for immediate use by 
the execution unit. 


The Memory Management Unit (MMU) consists of a 
segmentation unit and a paging unit. Segmentation 
allows the managing of the logical address space by 
providing an extra addressing component, one that 
allows easy code and data relocatability and efficient 
sharing. The paging mechanism operates beneath and 
is transparent to the segmentation process to allow 
management of the physical address space. Each 
segment is divided into one or more 4-Kb pages. To 
implement a virtual memory system, the AmM386DX/DXL 
microprocessor supports full restartability for all page 
and segment faults. 


Memory is organized into one or more variable length 
segments, each up to 4 Gb insize. A given region of the 
linear address space, a segment, can have attributes 
associated with it. These attributes include its location, 
size, type (i.e., stack, code, or data), and protection 
characteristics. Each task on an Am386DX/DXL micro- 
processor can have a maximum of 16,381 segments of 
up to 4 Gb each, thus providing 64 tb (trillion bytes) or 
virtual memory to each task. 


The segmentation unit provides four levels of protection 
for isolating and protecting applications and the 
operating system from each other. The hardware 
enforced protection allows the design of system with a 
high degree of integrity. 


The Am386DX/DXL microprocessor has two modes of 
operation: Real Address Mode (Real Mode) and Pro- 
tected Virtual Address Mode (Protected Mode). In Real 
Mode, the Am3886DX/DXL device operates as a very 
fast 8086 but with 32-bit extensions, if desired. Real 
Mode is required primarily to setup the processor for 
Protected Mode operation. Protected Mode provides 
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address to the sophisticated memory management, 
paging, and privilege capabilities of the processor. 


Within Protected Mode, software can perform a task 
switch to enter into tasks designated as Virtual 8086 
Mode tasks. Each such task behaves with 8086 
semantics, thus allowing 8086 software (an application 
program or an entire operating system) to execute. The 
Virtual 8086 tasks can be isolated and protected from 
one another and the host Am386DX/DXL microproces- 
sor operating system by the use of paging and the 1/O 
Permission Bitmap. 


Finally, to facilitate high-performance system hardware 
designs, the Am386DX/DXL microprocessor bus inter- 
face offers address pipelining, dynamic data bus sizing, 
and direct Byte Enable signals for each byte of the 
data bus. These hardware features are described fully 
beginning in the Functional Data section. 


Register Overview 


The Am386DX/DXL microprocessor has 32 register re- 
sources in the following categories. 


e General Purpose Registers 

e Segment Registers 

e Instruction Pointer and Flags 

e Control Registers 

e System Address Registers 

e Debug Registers 

e Test Registers 

The registers are a superset of the 8086, 80186, and 
80286 registers, so all 16-bit 80186 and 80286 


registers are contained within the 32-bit AM386DX/DXL 
microprocessor. 


Figure 1 shows all the Am3886DX/DXL microprocessor 
base architecture registers that include the general ad- 
dress and data registers, the instruction pointer, and the 
flags register. The contents of these registers are task- 
specific, so these registers are automatically loaded 
with a new context upon a task switch operation. 


The base architecture also includes six directly accessi- 
ble segments, each up to 4 Gb in size. The segments 
are indicated by the selector values placed in 
Am386DX/DXL CPU segment registers of Figure 1. 
Various selector values can be loaded as a program 
executes, if desired. 


The selectors are also task specific, so the segment reg- 
isters are automatically loaded with new context upon a 
task switch operation. 


The other types of registers Control, System Address, 
Debug, and Test are primarily used by system software. 
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General Data and Address Registers 


EAX 
EBX 
ECX 
EDX 
ESI 

EDI 

EBP 
ESP 





Segment Selector Registers 


15 0 
CS Code 
ss _ Stack 
DS 
ES 
Data 
FS 
GS 
Instruction Pointer and Flags Registers 
31 16 15 0 
a a ee 
| CT tacs | eFiacs 
15021B—004 


Figure 1. Base Architecture Registers 


Register Descriptions 
General-Purpose Registers 


The eight general-purpose registers of 32 bits hold data 
or address quantities. The general registers, Figure 2, 
support data operands of 1, 8, 16, 32, and 64 bits and bit 
fields of 1 to 32 bits. They support address operands of 
16 and 32 bits. The 32-bit registers are named EAX, 
EBX, ECX, EDX, ESI, EDI, EBP, and ESP. 


The least significant 16 bits of the registers can be ac- 
cessed separately. This is done by using the 16-bit 
names of the registers AX, BX, CX, DX, SI, DI, BP, and 
SP. When accessed as a 16-bit operand, the upper 
16 bits of the register are neither used nor changed. 


Finally, 8-bit operations can individually access the 
lower byte (bits 7-0) and the higher byte (bits 15-8) of 
general purpose registers AX, BX, CX, and DX. The 
lower bytes are named AL, BL, CL, and DL, respec- 
tively. The higher bytes are named AH, BH, CH, and DH, 
respectively. The individual byte accessibility offers 
additional flexibility for data operations, but is not used 
for effective address calculation. 


EAX 
EBX 
ECX 
EDX 
ES| 

EDI 

EBP 
ESP 


EIP 
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Figure 2. General Registers 
and Instruction Pointer 


Instruction Pointer 


The instruction pointer, Figure 2, is a 32-bit register 
named EIP. EIP holds the offset of the next instruction 
to be executed. The offset is always relative to the base 
of the code segment (CS). The lower 16 bits (bits 15—0) 
of EIP contain the 16-bit instruction pointer named IP, 
which is used by 16-bit addressing. 


Flags Register 


The Flags Register is a 32-bit register named EFLAGS. 
The defined bits and bit fields within EFLAGS, shown in 
Figure 3, control certain operations and indicate status 
of the Am386DX/DXL microprocessor. The lower 16 bits 
(bits 15-0) of EFLAGS contain the 16-bit flag register 
named FLAGS, which is most useful when executing 
8086 and 80286 code. 


Note in the following descriptions, set means set to 1 
and reset means reset to 0. 


VM __ (Virtual 8086 Mode, bit 17) 


The VM bit provides Virtual 8086 Mode within 
Protected Mode. If set while the Am386DX/DXL 
microprocessor is in Protected Mode, the 
Am386DX/DXL microprocessor will switch to Vir- 
tual 8086 operation, handling segment loads as 
the 8086 does, but generating Exception 13 faults 
on privileged op-codes. The VM bit can be set only 
in Protected Mode by the IRET instruction (if cur- 
rent privilege level = 0) and by task switches at any 
privilege level. The VM bit is unaffected by POPF. 
PUSHF always pushes a 0 in this bit, even if exe- 
cuting in Virtual 8086 Mode. The EFLAGS image 
pushed during interrupt processing or saved dur- 
ing task switches will contain a 1 in this bit if the in- 
terrupted code was executing as a Virtual 8086 
task. 
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RF 


NT 


(Resume Flag, bit 16) 


The FF flag is used in conjunction with the debug 
register breakpoints. It is checked at instruction 
boundaries before breakpoint processing. When 
RF is set, it causes any debug fault to be ignored 
on the next instruction. RF is then automatically 
reset at the successful completion of every in- 
struction (no faults are signaled) except the IRET 
instruction and the POPF instruction. (JMP, 
CALL, and INT instructions causing a task switch.) 
These instructions set RF to the value specified by 
the memory image. For example, at the end of the 
breakpoint service routine, the IRET instruction 
can pop an EFLAGS image having the RF bit set 
and resume the program’s execution at the break- 
point address without generating another break- 
point fault on the same location. 


(Nested Task, bit 14) 


This flag applies to Protected Mode. NT is set to 
indicate that the execution of this task is nested 
within another task. If set, it indicates that the cur- 
rent nested task’s Task State Segment (TSS) has 
a valid back link to the previous task’s TSS. This 
bit is set or reset by control transfers to other 
tasks. The value of NT in EFLAGS is tested by the 
IRET instruction to determine whether to do an 
inter-task return or an intra-task return. A POPF 
or an IRET instruction will affect the setting of this 
bit according to the image popped at any privilege 
level. 


IOPL (Input/Output Privilege Level, bits 12—13) 


OF 


DF 


This two-bit field applies to Protected Mode. IOPL 
indicates the numerically maximum CPL (current 
privilege level) value permitted to execute 1/O 
instructions without generating an Exception 13 
fault or consulting the I/O Permission Bitmap. It 
also indicates the maximum CPL value allowing 
alteration of the IF (INTR Enable Flag) bit when 
new values are popped into the EFLAGS register. 
POPF and IRET instruction can alter the IOPL 
field when executed at CPL=0. Task switches 
can always alter the IOPL field when the new flag 
image is loaded from the incoming task’s TSS. 


(Overflow Flag, bit 11) 


OD is set if the operation resulted in a signed over- 
flow. Signed overflow occurs when the operation 
resulted in carry/borrow into the sign bit (high- 
order bit) of the result but did not result in a carry/ 
borrow out of the high-order bit or vice-versa. For 
8-, 16-, and 32-bit operations, OF is set according 
to overflow at bits 7, 15, and 31, respectively. 


(Direction Flag, bit 10) 


DF defines whether ESI and/or EDI registers 


postdecrement or postincrement during the sg 


TF 


SF 


ZF 


AF 


PF 


CF 
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instructions. Postincrement occurs if DF is reset. 
Postdecrement occurs if DF is set. 


(INTR Enable Flag, bit 9) 


The IF flag, when set, allows recognition of exter- 
nal interrupts signaled onthe INTR pin. When IF is 
reset, external interrupts signaled on the INTR are 
not recognized. IOPL indicates the maximum CPL 
value allowing alteration of the IF bit when new 
values are popped into EFLAGS or FLAGS. 


(Trap Enable Flag, bit 8) 


TF controls the generation of Exception 1 trap 
when single-stepping through code. When TF is 
set, the Am386DX/DXL microprocessor gener- 
ates an Exception 1 trap after the next instruction 
is executed. When TF is reset, Exception 1 traps 
occur only as a function of the breakpoint ad- 
dresses loaded into debug register DR3—DRO. 


(Sign Flag, bit 7) 


SF is set if the high-order bit of the result is set; it is 
reset otherwise. For 8-, 16-, and 32-bit oper- 
ations, SF reflects the state of bits 7, 15, and 31, 
respectively. 


(Zero Flag, bit 6) 


ZF is setif all bits of the result are 0. Otherwise it is 
reset. 


(Auxiliary Carry Flag, bit 4) 


The Auxiliary Flag is used to simplify the addition 
and subtraction of packed BCD quantities. AF is 
set if the operation resulted in a carry out of bit 
3 (addition) or a borrow into bit 3 (subtraction). 
Otherwise, AF is reset. AF is affected by carry out 
of, or borrow into, bit 3 only; regardless of overall 
operand length: 8, 16, or 32 bits. 


(Parity flags, bit 2) 


PF is set if the low-order 8 bits of the operation 
contain an even number of 1s (even parity). PF is 
reset if the low-order 8 bits have odd parity. PFisa 
function of only the low-order 8 bits, regardless of 
operand size. 


(Carry Flag, bit 0) 


CF is set if the operation resulted in a carry out 
of (addition) or a borrow into (subtraction) the 
high-order bit. Otherwise, CF is reset. For 8-, 16-, 
or 32-bit operations, CF is set according to carry/ 
borrow at bits 7, 15, or 31, respectively. 
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Direction Flag 


Trap Flag 


Virtual Mode — | ae Carry Flag 
Resume Flag Parity Flag 
Nested Task Flag Auxiliary Carry 
I/O Privilege Level Zero Flag 

Overflow Sign Flag 


Interrupt Enable 


Note: 0 indicates “Reserved for Future Use.” Do not define; see Section Compatibility. 
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Figure 3. Flags Registers 
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Figure 4. Segment Registers and Associated Descriptor Registers 


Segment Registers 


Six 16-bit segment registers hold segment selector 
values identifying the currently addressable memory 
segments. Segment registers are shown in Figure 4. In 
Protected Mode, each segment may range in size from 
one byte up to the entire linear and physical space of the 
machine, 4 Gb (2° bytes). If a maximum sized segment 
is used (limit = FFFFFFFFH), it shouldbe Dword aligned 
(i.e., the least two significant bits of the segment base 
should be zero). This alignment will avoid a segment 
limit violation (Exception 13) caused by the wrap 
around. In Real Address Mode, the maximum segment 
size is fixed at 64 Kb (2"¢ bytes). 


The six segments addressable at any given moment are 
defined by the segment registers: CS, SS, DS, ES, FS, 
and GS. The selector in SS indicates the current stack 


segment; the selectors in DS, ES, FS, and GS indicate 
the current data segments. 


Segment Descriptor Registers 


The segment descriptor registers are not programmer 
visible, yet it is very useful to understand their content. 
Inside the Am386DX/DXL microprocessor, a descriptor 
register (programmer invisible) is associated with each 
programmer-visible segment register, as shown by 
Figure 4. Each descriptor register holds a 32-bit seg- 
ment base address, a 32-bit segment limit, and the 
other necessary segment attributes. 


When a selector value is loaded into a segment register, 
the associated descriptor register is automatically up- 
dated with the correct information. In Real Address 
Mode, only the base address is updated directly (by 
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shifting the selector value four bits to the left), since the 
segment maximum limit and attributes are fixed in Real 
Mode. In Protected Mode, the base address, the limit, 
and the attributes are all updated per the contents of the 
segment descriptor indexed by the selector. 


Whenever a memory reference occurs, the segment de- 
scriptor register associated with the segment being 
used is automatically involved with the memory refer- 
ence. The 32-bit segment base address becomes a 
component of the linear address calculation, the 32-bit 
limit is used for the limit-check operation, and the attrib- 
utes are checked against the type of memory reference 
requested. 


Control Registers 


The Am386DX/DXL microprocessor has three control 
registers of 32 bits: CRO, CR2, and CR3 to hold machine 
state of a global nature (not specific to an individual 
task). These registers, along with System Address Reg- 
isters described in the next section, hold machine state 
that affects all tasks in the system. To access the Con- 
trol Registers, load and store instructions are defined. 


CRO: Machine Control Register (Includes 80286 
Machine Status Word) 


CRO, shown in Figure 5, contains six defined bits for 
control and status purposes. The low-order 16 bits of 
CRO are also known as the Machine Status Word 
(MSW) for compatibility with 80286 Protected Mode. 
LMSW and SMSW instructions are taken as special ali- 
ases of the load and store CRO operations, where only 
the low-order 16 bits of CRO are involved. For compati- 
bility with 80286 operating systems, the Am386DX/DXL 
microprocessor LMSW instructions work in an identical 
fashion to the LMSW instruction on the 80286 (i.e., it 
only operates on the low-order 16 bits of CRO and it 
ignores the new bits in CRO). New Am386DX/DXL mi- 
croprocessor operating systems should use the MOV 
CRO, Reg instruction. 


The defined CRO bits are described below. 
PG (Paging Enable, bit 31) 


The PG bit is set to enable the on-chip paging unit. 
It is reset to disable the on-chip paging unit. 


31 24123 16|15 8 |7 0 
P TIE}M]P 
G S|M|PJE 


penn 


TS 


EM 


MP 


PE 
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(Reserved, bit 4) 


This bit is Reserved for Future Use. When loading 
CRO care should be taken to not alter the value of 
this bit. 


(Task Switched, bit 3) 


TS is automatically set whenever a task switch 
operation is performed. If TS is set, acoprocessor 
ESCape op-code will cause a Coprocessor Not 
Available trap (Exception 7). The trap handler 
typically saves a 387DX math coprocessor con- 
text belonging to a previous task, loads a 387DX 
math coprocessor state belonging to the current 
task, and clears the TS bit before returning to the 
faulting coprocessor op-code. 


(Emulate Coprocessor, bit 2) 


The Emulate coprocessor bit is set to cause all 
coprocessor op-codes to generate a Coprocessor 
Not Available fault (Exception 7). Itis reset to allow 
coprocessor op-codes to be executed on an ac- 
tual 387DX math coprocessor (this is the default 
case after reset). Note that the WAIT op-code is 
not affected by the EM bit setting. 


(Monitor Coprocessor, bit 1) 


The MP bit is used in conjunction with the TS bit to 
determine if the WAIT op-code will generate a 
Coprocessor Not Available fault (Exception 7) 
when TS=1. When both MP=1 and TS =1, the 
WAIT op-code generates a trap. Otherwise, 
the WAIT op-code does not generate a trap. Note 
that TS is automatically set whenever a task 
switch operation is performed. 


(Protection Enable, bit 0) 


The PE bit is set to enable the Protected Mode. If 
PE is reset, the processor operates again in Real 
Mode. PE may be set by loading MSW or CRO. PE 
can be reset only by a load into CRO. Resetting 
the PE bit is typically part of a longer instruction 
sequence needed for proper transition from Pro- 
tected Mode to Real Mode. Note that for strict 
80286 compatibility, PE cannot be reset by the 
LMSW instruction. 


CRO 





MSW 


Note: 0 indicates “Reserved for Future Use.” Do not define; see Section Compatibility. 


Figure 5. Control Register 0 
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CR1: Reserved 
CR1 is reserved for future processors. 
CR2: Page Fault Linear Address 


CR2, shown in Figure 6, holds the 32-bit linear address 
that caused the last page fault detected. The error code 
pushed onto the page fault handler’s stack when it is in- 
voked provides additional status information on this 
page fault. 


CR3: Page Directory Base Address 


CR3, shown in Figure 6, contains the physical base 
address of the page directory table. The Am386DX/DXL 
microprocessor page directory table is always page- 
aligned (4-Kb aligned). Therefore, the lowest 12 bits 
of CR3 are ignored when written and they store as 
undefined. 


A task switch through a TSS that changes the value in 
CR3, or an explicit load into CR3 with any value, will in- 
validate all cached page table entries in the paging unit 
cache. Note that if the value in CR3 does not change 
during the task switch, the cached page table entries are 
not flushed. 


System Address Registers 


Four special registers are defined to reference the 
tables or segments supported by the 80286 CPU and 
Am386DX/DXL microprocessor protection model. 


These tables or segments are: 


GDT (Global Descriptor Table) 

IDT (Interrupt Descriptor Table) 

LDT (Local Descriptor Table) 

TSS (Task State Segment) 
The addresses of these tables and segments are stored 
in special registers, the System Address and System 
Segment Registers illustrated in Figure 7. These 
registers are named GDTR, IDTR, LDTR, and TR, re- 
spectively. The Protected Mode Architecture section 
describes the use of these registers. 
GDTR and IDTR 


These registers hold the 32-bit linear base address and 
16-bit limit of the GDT and IDT, respectively. 

The GDT and IDT segments, since they are global to 
all tasks in the system, are defined by 32-bit linear 
addresses (subject to page translation if paging is en- 
abled) and 16-bit limit values. 

LDTR and TR 


These registers hold the 16-bit selector for the LDT 
descriptor and the TSS descriptor, respectively. 


The LDT and TSS segments, since they are task- 
specific segments, are defined by selector values stored 
in the system segment registers. Note that a segment 
descriptor register (programmer-invisible) is associated 
with each system segment register. 





Page Fault Linear Address Register CR2 
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Note: 0 indicates “Reserved for Future Use.” Do not define; see Section Compatibility. 
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Figure 7. System Address and System Segment Registers 
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Debug and Test Registers 


Debug Registers: The six programmer accessible de- 
bug registers provide on-chip support for debugging. 
Debug Registers DR3—-DRO specify the four linear 
breakpoints. The Debug Control Register DR7 is used 
to set the breakpoints, and the Debug Status Register 
DR6 displays the current state of the breakpoints. The 
use of the debug registers is described inthe Debugging 
Support section. 


Test Registers: Two registers are used to control the 
testing of the RAM/CAM (Content Addressable Memo- 
ries) inthe Translation Look-Aside Buffer portion of the 
Am386DX/DXL microprocessor. TR6 is the command 
test register, and TR7 is the data register that contains 
the data of the Translation Look-Aside buffer test. Their 
use is discussed in the Testability section. Figure 8 
shows the Debug and Test registers. 


Debug Registers P 





Test Registers (For Page Cache) ; 


DRO 
DR1 
DR2 
DR3 
DR4 
DR5 
DR6 
DR7 


31 





31 


TRE 
TR7 
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Figure 8. Debug and Test Registers 
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Register Accessibility 


There are a few differences regarding the accessibility 
of the registers in Real and Protected Mode. Table 1 
summarizes these differences. See the Protected Mode 
Architecture section for further details. 


Compatibility 


VERY IMPORTANT NOTE: 
COMPATIBILITY WITH FUTURE PROCESSORS 


In the preceding register descriptions, note certain 
Am386DX/DXL microprocessor register bits are Re- 
served for Future Use. When reserved bits are called 
out, treat them as fully undefined. This is essential for 
software compatibility with future processors! Followthe 
guidelines below: 


1. Do not depend on the state of any undefined bits 
when testing the values of defined register bits. 
Mask them out when testing. 


2. Do not depend on the state of any undefined bits 
when storing them to memory or another register. 


3. Do not depend on the ability to retain information 
written into any undefined bits. 


4. When loading registers, always load the undefined 
bits as zeros. 


5. However, registers that have been previously stored 
may be reloaded without masking. 


Depending upon the values of undefined register bits 
will make your software dependent upon the unspeci- 
fied AmM386DX/DXL microprocessor handling of these 
bits. Depending on undefined values risks making soft- 
ware incompatible with future processors that define us- 
ages for the Am386DX/DXL CPU undefined bits. Avoid 
any software dependence upon the state of undefined 
Am386DX/DXL CPU register bits. 


Register 
General Registers 
Segment Registers 
Flag Registers 
Control Registers 
GDTR 
IDTR 
LDTR 
TR 
Debug Control 
Test Registers 


Table 1. Register Usage 


Real Mode Protected Mode 
| toad | Store | Load | Store | Load _| 
| Yes {Yes { PL=0 | PL=0 [| No | 
| Yes | Yes {| Pl=0 | Yes | No __| 
| Yes | Yes | PlL=o | Yes | No _| 
| No | No | PlL=0 | Yes | _No_ 


[ves [ves | Pt-o | Pt-o [No 


Notes: PL = 0: The registers can be accessed only when the current privilege level is zero. 
IOPL: The PUSHF and POPF instructions are made I/O Privilege Level sensitive in Virtual 8086 Mode. 
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Use In 
Virtual 8086 Mode 


Store 
Yes 
Yes 

IOPL 
Yes 
Yes 
Yes 

No 
No 
No 
No 
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instruction Set 
Instruction Set Overview 


The instruction set is divided into nine categories of 
operations. 


Data Transfer 

Arithmetic 

Shift/Rotate 

String Manipulation 

Bit Manipulation 

Control Transfer 

High Level Language Support 
Operating System Support 
Processor Control 


These Am386DX/DXL microprocessor instructions are 
listed in Table 2. 


All Am386DX/DXL microprocessor instructions operate 
on either 0, 1, 2, or 3 operands where an operand re- 
sides in a register in the instruction itself or in memory. 
Most zero operand instructions (e.g., CLI, STI) take only 
one byte. One operand instructions generally are two 
bytes long. The average instruction is 3.2-bytes long. 
Since the Am386DX/DXL device has a 16-byte instruc- 
tion queue, an average of 5 instructions will be 
prefetched. The use of two operands permits the follow- 
ing types of common instructions. 


Register to Register 
Memory to Register 
Immediate to Register 
Register to Memory 
Immediate to Memory 


The operands can be either 8-, 16-, or 32-bits long. As a 
general rule, when executing code written for the 
Am386DX/DXL microprocessor (32-bit code), operands 
are 8 or 32 bits; when executing existing 80286 or 8086 
code (16-bit code), operands are 8 or 16 bits. Prefixes 
can be added to instructions that override the default 
length of the operands (i.e., use 32-bit operands for 
16-bit code or 16-bit operands for 32-bit code). 


Addressing Modes 
Addressing Modes Overview 


The Am386DX/DXL microprocessor provides a total of 
11 addressing modes for instructions to specify oper- 
ands. The addressing modes are optimized to allow the 
efficient execution of high-level languages such as C 
and FORTRAN, and they coverthe vast majority of data 
references needed by high-level languages. 


Register and Immediate Modes 


Two of the addressing modes provide for instructions . 
that operate on register or immediate operands: 


Register Operand Mode: The operand is located in 
one of the 8-, 16-, or 32-bit general registers. 


immediate Operand Mode: The operand is included in 
the instruction as part of the op-code. 


32-Bit Memory Addressing Modes 


The remaining nine modes provide a mechanism for 
specifying the effective address of an operand. The lin- 
ear address consists of two components: the segment 
base address and an effective address. The effective 
address is calculated by using combinations of the fol- 
lowing four address elements. 


Displacement: An 8- or 32-bit immediate value follow- 
ing the instruction. 


Base: The contents of any generai-purpose register. 
The Base registers are generally used by compilers to 
point to the start of the local variable area. 


Index: The contents of any general-purpose register ex- 
cept for ESP. The Index registers are used to access the 
elements of an array, or a string of characters. 


Scale: The index register’s value can be multiplied by a 
scale factor of either 1, 2, 4, or 8. Scaled index mode is 
especially useful for accessing arrays or structures. 


Combinations of these four components make up the 
nine additional addressing modes. There is no perform- 
ance penaity for using any of these addressing combi- 
nations, since the effective address calculation is 
pipelined with the execution of other instructions. 


The one exception is the simultaneous use of Base and 
Index components that requires one additional clock. 


As shown in Figure 9, the effective address (EA) of 
an operand is calculated according to the following 
formula. 


EA = Base Reg + (Index Reg - Scaling) + Displacement 


Direct Mode: The operand’s offset is contained as part 
of the instruction as an 8-, 16-, or 32-bit displacement. 


Example: INC Word PTR [500] 


Register Indirect Mode: A Base register contains the 
address of the operand. 


Example: MOV [ECX], EDX 


Based Mode: A Base register’s contents is added to a 
Displacement to form the operands offset. 


Example: MOV ECX, [EAX + 24] 
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Table 2. Am386DX/DXL Microprocessor Instructions 


Table 2a. Data Transfer 


PUSH 
PUSHA| Push allregistere on stack 
POPA 
XCHG | Exchange operand register SiS 


XLAT Translate 


: 
WOE 
cba 


Input/Output | 
Input operand from |/O space 
Output operand to I/O space 


Address Object 


Gs 
LSS Load pointer into S (Stack) segment register 
SAHF 









ae] 






G) 


O 
< 


= 









= 
S) 


QOJOl|S/E 
Zi0;O0 
<|< 
N 
x |< 


QO 












PUSHF | Push flags onto stack | 
POPF Pop flags off stack 


PUSHFD | Push EFLAGS onto stack 


POPFD_| PopEFLAGS off stack 


Set Carry Flag 


CLC 
CLD 
CMC 
STC 
STD 


Set Direction Flag 


Table 2b. Arithmetic Instructions 


A ASCII adjust for addition 


Decimal adjust for addition 











O;> >| > 
> O;O 
>| > O;O 






| SUB | Subtract operands 
Subtract with borrow 
DEC Decrement operand by 1 


Negate operand 
Compare operands 
Decimal adjust for subtraction 


AAS ASCII adjust for subtraction 


Multiplication | 
Multiply Double/Single Precision | 
IMUL Integer multiply 
| AA ASCII adjust after multiply | 
Divide unsigned 


IDIV. | Integer divide 


AAD 


ki 
o01@ 


O 
> 
ep) 


Cc 


> = 
= - 










ASCII adjust before division 


9 
< 


Table 2c. String Instructions 


MOVS | Move byte or Word, Dword string 










INS Input string from I/O space 


OUTS | Output string to I/O space 


CMPS 
SCAS | Scan Byte or Word, Dword sting 
ODS 
STOS_| Store byte or Word, Dword sting 


REPE/ 
REPZ | Repeat while equal/zero 


RENE/ 
REPNZ | Repeat while not equal/not zero 
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Table 2. Am386DX/DXL Microprocessor Instructions (continued) 


Table 2d. Logical Instructions 


“NOT” operand | 
“AND” operands 
“Inclusive OR” operands | 
| “Exclusive OR” operands 
| TEST | “Test” operands 
SHL/SHR_ | Shift logical left or right 
SAL/SAR | Shift arithmetic left or right 


SHLD/ 
| Double shift left or right 


NOT 
AND 
| XOR 


SHRD 


| ROL/ROR | Rotate left/right 


RCL/RCR | Rotate through carry left/right 





Table 2e. Bit Manipulation Instructions 


aa Ci a aa 
[BTC | Bit Test and Complement = 
7 









Bit Scan Forward 


Bit Scan Reverse 








Table 2f. Program Control Instructions 


| _ Conditional Transfers 
SETCC Set byte equal to condition code | 





JA/JINBE Jump if above/not below nor equal 


| JAE/JINB- | Jump if above or equal/not below 
| JB/JNAE_ | Jump if below/not above nor equal 
| JBE/JNA Jump if below or equal/not above 








[EUZ | Jumpifequaizero —SC—*dY 
NS 
O 
S 












FINS | Jumpifnotsin 
[JO | Jumpifoverow ——SSSSSCSC~* 
[LIPPE | Jumpifpariyipariy even =| 
Jump if sign 





Table 2f. Program Control Instructions 
(continued) 


| RET 
| JMP | 


Pump 


Iteration Controls | 
Loop___|[top ———Cs—S—CSY 


LOOPE/ 
LOOPZ Loop if equal/zero 
Loop if not equal/not zero | 


LOOPNE/ 
JUMP if register CX =0 


LOOPNZ 


JCXZ 
interupt SSCS 
Interrupt if overflow | 


Return from interrupt/task 


Clear interrupt enable | 


Set interrupt enable 

































INTO 
IRET 


oe | 








CLI 
STI | 


Table 2g. High Level Language Instructions 


BOUND | Check array bounds 
ENTER | Setup parameter block for entering procedure 
LEAVE 


Table 2h. Protection Model 


Store global descriptor table 
| Store interrupt descriptor table 
Store task register 





| SGDT 
| SIDT 
| STR 

| SLDT 
| LGDT 
| LIDT 













Store local descriptortable 
| Load global descriptortable 
| Load interrupt descriptortable | 
LTR | Loadtaskregister 
LLOT 


VERR/ 
VERW Verify segment for reading or writing 
LMSW Load machine status word (lower 16 bits 


of CRO) 
| SMSW 


Store machine status word 


Table 2i. Processor Control Instructions 


a 


HLT 
WAIT | Wait until BUSY negated | 
esc [tscpe C*d 


LOCK Lock Bus 














p 
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Index Mode: An Index register’s contents is added to a 
Displacement to form the operands offset. 

Example: ADD EAX, TABLE [ESI] 
Scaled Index Mode: An Index register’s contents is mul- 
tiplied by a scaling factor that is added to a Displace- 
ment to form the operands offset. 

Example: IMUL EBX, TABLE [ESI 4], 7 

Based Index Mode: The contents of a Base register is 
added to the contents of an Index register to form the 
effective address of an operand. 

Example: MOV EAX, [ESI] [EBX] 
Based Scaled Index Mode: The contents of an Index 
register is multiplied by a Scaling factor and the result is 
added to the contents of a Base register to obtain the 
operands offset. 


Example: MOV ECX, [EDX « 8] [EAX] 


Segment Registers 


SS alacta 
Gs sna 
FS alee 
ES | p-Salaatos 
bs 
—» CS 





Descriptor Registers 


[access Figs G5 
[Assess Rohs FS 
[Access Fighis OS 
[Access Rights OS 
[uit 


Base Address 
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Based Index Mode with Displacement: The contents of 
an Index Register and a Base register’s contents and a 
Displacement are all summed together to form the 
operand offset. 

Example: ADD EDX, [ESI] [EBP + OOFFFFFOH] 
Based Scaled Index Mode with Displacement: The con- 
tents of an Index register are multiplied by a Scaling 
factor; the result is added to the contents of a Base reg- 
ister and a Displacement to form the operand’s offset. 


Example: MOV EAX, LOCALTABLE[EDI « 4] [EBP +80] 


[Base Register | 
Index Register 






Displacement 
(In Instruction) 


Effective Segment 
Address vy 
Linear 
yo 
| Target Address Address 
Selected 
Segment 
| Segment Base Address Base Address 
15021B-012 


Figure 9. Addressing Mode Calculations 
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Differences Between 16- and 32-Bit Addresses 


In order to provide software compatibility with the 80286 
and the 8086, the Am386DX/DXL microprocessor can 
execute 16-bit instructions in Real and Protected 
Modes. The processor determines the size of the in- 
structions it is executing by examining the D bit inthe CS 
segment descriptor. If the D bit is 0 then all operand 
lengths and effective addresses are assumed to be 16 
bits long. If the D bit is 1 then the default length for oper- 
ands and addresses is 32 bits. In Real Mode, the default 
size for operands and addresses is 16 bits. 


Regardless of the default precision of the operands or 
addresses, the Am386DX/DXL microprocessor is able 
to execute either 16- or 32-bit instructions. This is speci- 
fied via the use of override prefixes. Two prefixes, the 
Operand Size Prefix and the Address Length Prefix, 
override the value of the D bit on an individual instruction 
basis. 

Example: The processor is executing in Real Mode and the 
programmer needs to access the EAX registers. The assem- 
bler code for this might be MOV EAX, 32-bit MEMORYOP. An 
assembler automatically determines that an Operand Size 
Prefix is needed and generates it. 

Example: The D bit is 0 and the programmer wishes to use 
Scaled Index addressing mode to access an array. The 
Address Length Prefix allows the use of MOV Dx, 
TABLE[ESIe2]. The assembler uses an Address Length 
Prefix, since with D = 0, the default addressing mode is 16 bits. 


Example: The D bit is 1 and the program wants to store a 


16-bit quantity. The Operand Length Prefix is used to specify 
only a 16-bit value: MOV MEM16, DX. 


The Operand Length and Address Length prefixes can 
be applied separately or in combination to any instruc- 
tion. The Address Length Prefix does not allow ad- 
dresses over 64 Kb to be accessed in Real Mode. A 
memory address exceeding FFFFH will result ina Gen- 
eral Protection Fault. An Address Length Prefix only al- 
lows the use of the additional AM386DX/DXL micropro- 
cessor addressing modes. 


When executing 32-bit code, the Am386DX/DXL micro- 
processor uses either 8- or 32-bit displacements, and 
any register can be used as base or index registers. 
When executing 16-bit code, the displacements are 
either 8 or 16 bits, and the base and index register 
conform to the 80286 model. Table 3 illustrates the 
differences. 


Data Types 
The Am386DX/DXL microprocessor supports all data 
types commonly used in high-level languages. 


Bit: A single bit quantity. 
Bit Field: A group of up to 32 contiguous bits that spans a 
maximum of four bytes. 


Bit String: A set of contiguous bits on the Am386DX/ 
DXL microprocessor bit strings can be up to 4 Gb long. 


Byte: A signed 8-bit quantity. 

Unsigned Byte: An unsigned 8-bit quantity. 

Integer (Word): A signed 16-bit quantity. 

Long Integer (Double Word): A_ signed 32-bit 


quantity. All operations assume a 2’s complement 
representation. 


Unsigned Integer (Word): An unsigned 16-bit quantity. 
Unsigned Long Integer (Double Word): An unsigned 
32-bit quantity. 

Signed Quad Word: A signed 64-bit quantity. 
Unsigned Quad Word: An unsigned 64-bit quantity. 


Offset: A 16- or 32-bit offset only quantity that indirectly 
references another memory location. 


Pointer: A full pointer which consists of a 16-bit segment 
selector and either a 16- or 32-bit offset. 


Char: A byte representation of an ASCII alphanumeric 
or control character. 


String: A contiguous sequence of bytes, words, or 
Dwords. A string may contain between 1 byte and 4 Gb. 


BCD: A byte (unpacked) representation of decimal 
digits 0-9. 

Packed BCD: A byte (packed) representation of two 
decimal digits 0—9 storing one digit in each nibble. 


When the Am3886DX/DXL microprocessor is coupled 
with a387DX math coprocessor then the following com- 
mon floating point types are supported. 


Floating Point: A signed 32-, 64-, or 80-bit real number 
representation. Floating point numbers are supported 
by a 387DX compatible math coprocessor. 


Figure 10 illustrates the data types supported by the 
Am386DX/DXL microprocessor and a 387DX compat- 
ible math coprocessor. 


Table 3. Base and Index Registers for 16- and 32-Bit Addresses 


fe ee 16-Bit Addressing 32-Bit Addressing 


Base Register BX, BP 


Index Register Sl, Dl 


Scale Factor None 
Displacement | 0, 8, 16 bits 


Any 32-bit GP Register 
Any 32-bit GP Register 
Except ESP 

1,2, 4,8 

O, 8, 32 bits 





26 Am386 Microprocessors for Personal Computers 


AMD al 


7 0 7 0 
Signed Unsigned 
Byte . Byte 
Sign Bit —]L_E SY | 
Magnitude Magnitude 


1514 


15 + 0 0 
Signed Unsigned 
Word Word 
Sign Bit I _-MSB sl See 


ee Magnitude 


31 +3 +2 16 15 +1 0 0 


Signed 
Double 
Word 


Sign Bit i LMSB 
Magnitude 


31 +3 +2 16 15 5a 0 0 


Unsigned 
Double 
Word 


SSR NO ee ee eC ee ee | 
Magnitude 


63 +7 +6 48.47 +5 +4 32 31 +3 +2 1615+ 0 


Signed 
Quad 
Word 


Sign Bit oF LMSB 


Magnitude 
Binary 
Coded 
Decimal 
(BCD) BCD Digit N BCD Digit 1 BCD Digit 0 


7 +N 0 7 +1 07 0 0 
eee 


ASCII Character N ASCII Character 1 ASCIl Character 0 


7 +N 0 7 +1 07 0 0 
Packed ec0e 
BCD 


Most Significant Digit Least Significant Digit 


+N +1 


7/15 7/15 0 7/15 


Byte 
String 


Figure 10. Supported Data Types 
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+2 Gbits —2 Gbits 
210 
Bit 
String 
Bit 0 
34 +3 +2 +1 0 0 
Short 
32-Bit 
Pointer 
Se ee aa ne ae a ee el | 
Offset 
47 +5 +4 +3 +2 +1 0 0 
Long 
48-Bit 
Pointer 
ee rece 
Selector Offset 
39 +9 +8 +7 +6 +5 +4 +3 +2 +1 0 0 
Floating 
Point* 
Sign Bit I ; I i 
Exponent Magnitude 
+5 +4 43 +2 +1 0 


32-Bit 
Bit Field 
fg we 


1 to 32 Bits 


*Supported by 387DX-compatible math coprocessor. igelE OS 


Figure 10. Supported Data Types (continued) 
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Memory Organization 
Introduction 


Memory on the Am386DX/DXL microprocessor is di- 
vided up into 8-bit quantities (Bytes), 16-bit quantities 
(Words), and 32-bit quantities (Dword). Words are 
stored in two consecutive bytes in memory with the low- 
order byte at the lowest address, the high-order byte at 
the highest address. Dwords are stored in four consecu- 
tive bytes in memory with the low-order byte at the low- 
est address, the high-order byte at the highest address. 
The address of a word or Dword is the byte address of 
the low-order byte. 


In addition to these basic datatypes, the Am386DX/DXL 
microprocessor supports two larger units of memory: 
pages and segments. Memory can be divided up into 
one or more variable length segments, which can be 
swapped to disk or shared between programs. Memory 
can also be organized into one or more 4-Kb pages. 
Finally, both segmentation and paging can be com- 
bined, gaining the advantages of both systems. The 
Am886DX/DXL microprocessor supports both pages 
and segments in order to provide maximum flexibility to 
the system designer. Segmentation and paging are 
complementary. Segmentation is useful for organizing 
memory in logical modules, and as such is a tool for the 
application programmer, while pages are useful for the 
system programmer for managing the physical memory 
of a system. 


Address Spaces 


The Am386DX/DXL microprocessor has three distinct 
address spaces: logical, linear, and physical. A logical 
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address (also known as a virtual address) consists of a 
selector and an offset. A selector is the contents of a 
segment register. An offset is formed by summing all of 
the addressing components (Base, Index, Displace- 
ment) discussed in Section Memory Address Modes 
into an effective address. Since each task on AmM386DX/ 
DXL CPU has a maximum of 16K (2'4-1) selectors, and 
offsets can be 4 Gb (2° bits), this gives a total of 2 bits 
or 64 tb of logical address space per task. The program- 
mer sees this virtual address space. 


The segmentation unit translates the logical address 
space into a 32-bit linear address space. If the paging 
unit is not enabled then the 32-bit linear address corre- 
sponds to the physical address. The paging unit trans- 
lates the linear address space into the physical address 
space. The physical address is what appears on the 
address pins. 


The primary difference between Real Mode and Pro- 
tected Mode is how the segmentation unit performs the 
translation of the logical address into the linear address. 
In Real Mode, the segmentation unit shifts the selector 
left four bits and adds the result to the offset to form 
the linear address. While in Protected Mode, every se- 
lector has a linear base address associated with it. The 
linear base address is stored in one of two operating 
system tables (i.e., the Local Descriptor Table or Global 
Descriptor Table). The selector’s linear base address is 
added to the offset to form the final linear address. 


Figure 11 shows the relationship between the various 
address spaces. 


31 0 


BE3S-—BEO 
A31—A2 






Physical 
Memory 





Paging Unit 
(Optional Use) 













Linear 
Address 







Physical 
Address 
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Figure 11. Address Translation 
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Segment Register Usage 


The main data structure used to organize memory is the 
segment. On the Am386DX/DXL microprocessor, seg- 
ments are variable sized blocks of linear addresses that 
have certain attributes associated with them. There are 
two main types of segments: code and data. The seg- 
ments are of variable size and can be as small as 1 byte 
or as large as 4 Gb (2° bytes). 


Inorder to provide compact instruction encoding and in- 
crease processor performance, instructions do not need 
to explicitly specify which segment register is used. A 
default segment register is automatically chosen ac- 
cording to the rules of Table 4 (Segment Register Selec- 
tion Rules). In general, data references use the selector 
contained in the DS register; Stack references use the 
SS register; and Instruction fetches use the CS register. 
The contents of the Instruction Pointer provides the off- 
set. Special segment override prefixes allow the explicit 
use of a givensegment register, and override the implicit 
rules listed in Table 4. The override prefixes also allow 
the use of the ES, FS, and GS segment registers. 


There are no restrictions regarding the overlapping of 
the base addresses of any segments. Thus, all 6 seg- 
ments could have the base address set to zero and 
create a system with a 4-Gb linear address space. This 
creates a system where the virtual address space is the 
same as the linear address space. Further details of 
segmentation are discussed in Section Protected Mode 
Architecture. 


1/O Space 

The Am386DX/DXL microprocessor has two distinct 
physical address spaces: Memory and I/O. Generally, 
peripherals are placed in I/O space although the 
Am386DX/DXL CPU also supports memory-mapped 
peripherals. The I/O space consists of 64 Kb and can be 
divided into 64K 8-bit ports, 32K 16-bit ports, or 16K 
32-bit ports, or any combination of ports that add up to 
less than 64 Kb. The 64Kb I/O address space refers to 
physical memory rather than linear address since I/O in- 
structions do not go through the segmentation or paging 
hardware. The M/IO pin acts as an additional address 
line, thus allowing the system designer to easily deter- 
mine which address space the processor is accessing. 


The I/O ports are accessed via the IN and OUT I/O in- 
structions, with the port address supplied as an immedi- 
ate 8-bit constant in the instruction or in the DX register. 
All 8- and 16-bit port addresses are zero extended on 
the upper address lines. The 1/O instructions cause the 
M/IO pin to be driven Low. 


I/O port addresses OOF8H through OOFFH are reserved. 


interrupts 
interrupts and Exceptions 


Interrupts and exceptions alter the normal program 
flow, in order to handie external events, to report errors 
or exceptional conditions. The difference between 
interrupts and exceptions is that interrupts are used to 


Table 4. Segment Register Selection Rules 


| Type of Memory Reference Implied (Default) Segment Use Segment Override Prefixes Possible 


Destination of PUSH, PUSHF, INT, 
CALL, PUSHA Instructions 
Source of POP, POPA, POPF, 
IRET, RET Instructions 


Destination of STOS, MOVS, REP 
STOS, REP MOVS Instructions 
(DI is Base Register) 


Other Data References with 
Effective Address Using Base 
Register of: 


[EAX] 
[EBX] 
[ECX] 
[EDX] 
[ESI] 

[EDI] 

[EBP] 
[ESP] 


CS, SS, ES, FS, GS 
CS, SS, ES, FS, GS 
CS, SS, ES, FS, GS 
CS, SS, ES, FS, GS 
CS, SS, ES, FS, GS 
CS, SS, ES, FS, GS 
CS, SS, ES, FS, GS 
CS, SS, ES, FS, GS 
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handle asynchronous external events while excep- 
tions handle instruction faults. Although a program can 
generate a software interrupt via an INT n instruction, 
the processor treats software interrupts as exceptions. 


Hardware interrupts occur as the result of an external 
event and are classified into two types: maskable or 
non-maskable. Interrupts are serviced after the execu- 
tion of the current instruction. After the interrupt handler 
is finished servicing the interrupt, execution proceeds 
with the instruction immediately after the interrupted in- 
struction. The differences between the interrupts are 
discussed in the Maskable Interrupt and Non-Maskable 
Interrupt sections. 


Exceptions are classified as faults, traps, or aborts de- 
pending on the way they are reported, and whether or 
not restart of the instruction causing the exception is 
supported. Faults are exceptions that are detected and 
serviced before the execution of the faulting instruction. 
A fault occurs in a virtual memory system when the 
processor references a page or a segment that is not 
present. The operating system fetches the page or seg- 
ment from disk, and then the Am386DX/DXL micropro- 
cessor restarts the instruction. Traps are exceptions 
that are reported immediately after the execution of the 
instruction that caused the problem. User defined inter- 
rupts are examples of traps. Aborts are exceptions that 
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do not permit the precise location of the instruction caus- 
ing the exception to be determined. Aborts are used to 
report severe errors, such as a hardware error or illegal 
values in system tables. 


Thus, when an interrupt service routine has been com- 
pleted, execution proceeds from the instruction immedi- 
ately following the interrupted instruction. On the other 
hand, the return address from an exception fault routine 
will always point at the instruction causing the exception 
and include any leading instruction prefixes. Table 5 
summarizes the possible interrupts for the Am386DX/ 
DXL microprocessor and shows where the return ad- 
dress points. 


The Am386DX/DXL microprocessor has the ability to 
handle up to 256 different interrupts/exceptions. In order 
to service the interrupts, a table with up to 256 interrupt 
vectors must be defined. The interrupt vectors are sim- 
ply pointers to the appropriate interrupt service routine. 
In Real Mode (see Section Real Mode Introduction), 
the vectors are 4 byte quantities, a Code Segment 
plus a 16-bit offset; in Protected Mode, the interrupt 
vectors are 8 byte quantities that are put in an Inter- 
rupt Descriptor Table (see Section Introduction). Of 
the 256 possible interrupts, 32 are Reserved for Future 
Use, the remaining 224 are free to be used by the 
system designer. 


Table 5. Interrupt Vector Assignments 










Interrupt 
Number 





Return Address 
Points to 
Faulting 
instructions Which Can Cause Exceptions Instruction Type 


[DivideEror | IV, ——“‘“‘*LSCCéNtws SY 
[Debug Exception | 1 [any instrugion SSCs TR 
TNMUinterrupt_ ~*~ INT2orNMISSC~SCSCWN 
[One Byte interupt | 8 [NT SSS 














p NMI | 
| TRAP _| 


TRAP 


interrupt on Overtow | 4 NTO——SCSSSY| No YR 
[Array Bounds Check | 5 [BOUND—~—SSSS Vos —~dCAT 
Tinvaid Op-Code | 6 | Anyilegalinstructon ——~«dY Yes | FAULT 
[Device Not Available | 7 [€SG,warT | Yes | FAULT | 
[Double Feut | 8 | Any instruction that can generate an Exception 
[Seprcenor Seren Own [0 [eo 
nes cS oo 
[General Protection Fauk | 18 | Any memory reference 
[ResevedionFuuetse | ts [SSCS 4 
[coprocessor Enor ——~+d| 16 [eSo,waT——SCS~S SCs =O 
[Reserved torFuureUse [war] SSSSCSCSCSCS SSCS 
[Two Byte interupt ‘| -o-ees [Tn ———SCSCSSSS. NYT 


*Some debug exceptions may report both traps on the previous instruction and faults on the next instruction. 
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Interrupt Processing 
When an interrupt occurs the following actions happen. 


e First, the current program address and the Flags 
are saved on the stack to allow resumption of the 
interrupted program. 

e Next, an 8-bit vector is supplied to the Am386DX/ 
DXL microprocessor that identifies the appropriate 
entry in the interrupt table. The table contains the 
starting address of the interrupt service routine. 
Then, the user supplied interrupt service routine is 
executed. 

e Finally, when an IRET instruction is executed the old 
processor state is restored and program execution 
resumes at the appropriate instruction. 

The 8-bit interrupt vector is supplied to the Am386DX/ 

DXL microprocessor in several different ways: excep- 

tions supply the interrupt vector internally; software INT 

instructions contain or imply the vector; maskable hard- 
ware interrupts supply the 8-bit vector via the interrupt 
acknowledge bus sequence. Non-Maskable hardware 

interrupts are assigned to interrupt vector 2. 


Maskable Interrupt 


Maskable interrupts are the most common way the 
Am386DX/DXL microprocessor responds to asynchro- 
nous external hardware events. A hardware interrupt 
occurs when the INTR is pulled High and the Interrupt 
Flag bit (IF) is enabled. The processor only responds to 
interrupts between instructions (REPeat String instruc- 
tions have an interrupt window between memory 
moves, which allows interrupts during long string 
moves). When an interrupt occurs, the processor reads 
an 8-bit vector supplied by the hardware that identifies 
the source of the interrupt (one of 224 user defined inter- 
rupts). The exact nature of the interrupt sequence is dis- 
cussed in Section Functional Data. 


The IF bit inthe EFLAGS register is reset when an inter- 
rupt is being serviced. This effectively disables servicing 
additional interrupts during an interrupt service routine. 
However, the IF bit may be set explicitly by the interrupt 
handler to allow the nesting of interrupts. When an IRET 
instruction is executed the original state of the IF bit is 
restored. 


Non-Maskable Interrupt 


Non-maskable interrupts provide a method of servicing 
very high priority interrupts. A common example of 
the use of a non-maskable interrupt (NMI) would be to 
activate a power failure routine. When the NMI input 
is pulled High it causes an interrupt with an internally 
supplied vector value of 2. Unlike a normal hardware 
interrupt, no interrupt acknowledgment sequence is per- 
formed for NMI. 


While executing the NMI servicing procedure, the 
Am386DX/DXL microprocessor will not service further 
NMi requests until an interrupt return (IRET) instruction 
is executed or the processor is reset. If NMI occurs while 
currently servicing an NMI, its presence will be saved for 


servicing after executing the first IRET instruction. The 
IF bit is cleared at the beginning of an NMI interrupt to 
inhibit further INTR interrupts. 


Software Interrupts 


Athird type of interrupt/exception forthe Am386DX/DXL 
microprocessor is the software interrupt. An INT n in- 
struction causes the processor to execute the interrupt 
service routine pointed to by the nth vector in the inter- 
rupt table. 


A special case of the two byte software interrupt INT nis 
the one byte INT 3 or breakpoint interrupt. By inserting 
this one byte instruction in a program, the user can set 
breakpoints in the program as a debugging tool. 


A final type of software interrupt is the single step inter- 
rupt. It is discussed in the Debugging Support section. 


interrupt and Exception Priorities 


Interrupts are externally-generated events. Mask- 
able Interrupts (on the INTR input) and Non-Maskable 
Interrupts (on the NMI input) are recognized at instruc- 
tion boundaries. When NMI and maskable INTR are 
both recognized at the same instruction boundary, the 
Am386DX/DXL microprocessor invokes the NMI serv- 
ice routine first. If after the NMI service routine has been 
invoked, maskable interrupts are still enabled, then the 
Am386DX/DXL CPU invokes the appropriate interrupt 
service routine. 


Table 6a. Am386DX/DXL Microprocessor Priority 
for Invoking Service Routines in Case of 
Simultaneous External Interrupts 


| 2. INTR | 
Exceptions are internally-generated events. Exceptions 
are detected by the Am386DX/DXL microprocessor if in 
the course of executing an instruction, the Am3886DX/ 
DXL CPU detects a problematic condition. The 
Am386DX/DXL microprocessor then immediately in- 
vokes the appropriate exception service routine. The 
state of the AmM386DX/DXL CPU is such that the instruc- 
tion causing the exception can be restarted. If the ex- 
ception service routine has taken care of the problem- 


atic condition, the instruction will execute without caus- 
ing the same exception. 


It is possible for a single instruction to generate several 
exceptions (for example, transferring a single operand 
could generate two page faults if the operand location 
Spans two not present pages). However, only one ex- 
ception is generated upon each attempt to execute the 
instruction. Each exception service routine should cor- 
rect its corresponding exception, and restart the instruc- 
tion. inthis manner, exceptions are serviced until the in- 
struction executes successfully. 


As the Am3886DX/DXL microprocessor executes in- 
structions, it follows a consistent cycle in checking for 
exceptions, as shown in Table 6b. This cycle is repeated 
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as each instruction is executed and occurs in parallel 
with instruction decoding and execution. 


Instruction Restart 


The Am386DX/DXL microprocessor fully supports re- 
Starting all instructions after faults. If an exception is 
detected in the instruction to be executed (Exception 
Categories 4 through 10 in Table 6b), the Am386DX/ 
DXL device invokes the appropriate exception service 
routine. The Am3886DX/DXL microprocessor is in a state 
that permits restart of the instruction, for all cases but 
those in Table 6c. Note that all such cases are easily 
avoided by proper design of the operating system. 


Table 6b. Sequence of Exception Checking 


Consider the case of the Am386DX/DXL microprocessor 
having just completed an instruction. It then performs the 
following checks before reaching the point where the next 
instruction is completed: 


1. Check for Exception 1 Traps from the instruction just 
completed (single-step via Trap Flag or Data Breakpoints 
set in the Debug Registers). 


2. Check for Exception 1 Faults in the next instruction 
(Instruction Execution Breakpoint set in the Debug 
Registers for the next instruction). 


Check for external NMI and INTR. 


Check for Segmentation Faults that prevented fetching 
the entire next instruction (Exceptions 11 and 13). 


5. Check for Paging Faults that prevented fetching the 
entire next instruction (Exception 14). 


6. Check for Faults decoding the next instruction [Exception 
6 if illegal op-code; Exception 6 if in Real Mode or in 
Virtual 8086 Mode and attempting to execute an 
instruction for Protected Mode only (see Section 
Protection and I/O Permission Bitmap); or Exception 13 if 
instruction is longer than 15 bytes, or privilege violation in 
Protected Mode (i.e., not at IOPL or at CPL =0)}. 


7. \f WAIT op-code, check if TS = 1 and MP = 1 (Exception 7 
if both are 1). 


8. If ESCAPE op-code for numeric coprocessor, check if 
EM=1 or TS=1 (Exception 7 if either are 1). 


9. If WAIT op-code or ESCAPE op-code for numeric 
coprocessor, check ERROR input signal (Exception 16 if 
ERROR input is asserted). 


10. Check in the following order for each memory reference 
required by the instruction. 





a. Check for Segmentation Faults that prevent trans- 
ferring the entire memory quantity 
(Exceptions 11, 12, 13). 

b. Check for Page Faults that prevent transferring 
the entire memory quantity (Exception 14). 


Note that the order stated supports the concept of the paging mecha- 
nism being underneath the segmentation mechanism. Therefore, for 
any given code or data reference in memory, segmentation excep- 
tions are generated before paging exceptions are generated. 
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Table 6c. Conditions Preventing 
Instruction Restart 


1. Aninstruction causes a task switch to a task whose Task 
State Segment (TSS) is partially not present. (An entire 
not present TSS is restartable.) Partially present TSS’s 
can be avoided either by keeping the TSS’s of such tasks 
present in memory or by aligning TSS segments to reside 
entirely within a single 4K page (for TSS segments of 
4 Kb or less). 


2. Acoprocessor operand wraps around the top of a 64-Kb 
segment or a 4-Gb segment and spans three pages; and 
the page holding the middle portion of the operand is not 
present. This condition can be avoided by starting any 
segments containing coprocessor operands at a page 
boundary if the segments are approximately 64—200 Kb 
or larger (i.e., large enough for wraparound of the 
coprocessor operand to possibly occur). 


Note that these conditions are avoided by using the operating system 
designs mentioned in this table. 


Double Fault 


A Double Fault (Exception 8) results when the proces- 
sor attempts to invoke an exception service routine for 
the segment exceptions (10, 11, 12, or 13), but in the 
process of doing so, detects an exception other than a 
Page Fault (Exception 14). 


A Double Fault (Exception 8) will also be generated 
when the processor attempts to invoke the Page Fault 
(Exception 14) service routine, and detects an excep- 
tion other than a second Page Fault. In any functional 
system, the entire Page Fault service routine must re- 
main present in memory. 


Double Page faults however do not raise the Double 
Fault exception. If asecond Page Fault occurs while the 
processor is attempting to enter the service routine for 
the first time, then the processor will invoke the Page 
Fault (Exception 14) handler a second time rather than 
the Double Fault (Exception 8) handler. A subsequent 
fault, though, will lead to shutdown. 


When a Double Fault occurs, the Am386DX/DXL micro- 
processor invokes the exception service routine for 
Exception 8. 


Reset and Initialization 

When the processor is initialized or Reset, the registers 
have the values shown in Table 7. The Am386DX/DXL 
microprocessor will then start executing instructions 
near the top of physical memory, at location 
FFFFFFFOH. When the first Inter-Segment Jump or Call 
is executed, address lines A31—A20 will drop Low for 
CS-relative memory cycles, and the Am386DX/DXL 
microprocessor will only execute instructions in the 
lower 1 Mb of physical memory. This allows the system 
designer to use a ROM at the top of physical memory 
to initialize the system and take care of Resets. 
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RESET forces the Am386DX/DXL microprocessor to 
terminate all execution and local bus activity. No instruc- 
tion execution or bus activity will occur as long as Reset 
is active. Between 350- and 450-CLK2 periods after 
Reset becomes inactive, the Am386DX/DXL device 
will start executing instructions at the top of physical 
memory. 


Table 7. Register Values after Reset 


Flag Word UUUU0002H Note 1 

Machine Status Word (CRO) UUUUUUU0H Note 2 

Instruction Pointer OOOOFFFOH 

Code Segment FOOOH Note 3 

Data Segment OOOOH 

Stack Segment OO00H 

Extra Segment (ES) OOOOH 

Extra Segment (FS) OOOOH 

Extra Segment (GS) OOOOH 

DX Register Component and Note 5 
Stepping ID 

All Other Registers Undefined Note 4 


Notes: 


1. EFLAGS Register. The upper 14 bits of the EFLAGS register are 
undefined, VM (Bit 17) and RF (Bit 16) and 0 (Bit 15) are all other 
defined flag bits. 


2. CRO: (Machine Status Word). All of the defined fields in the CRO 
are 0 (PG Bit 31, TS Bit 3, EM Bit 2, MP Bit 1, and PE 
Bit 0). 

3. The code Segment Register (CS) will have its Base Address set 
to FFFFOOOOH and Limit set to OFFFFH. 


4. Allundefined bits are Reserved for Future Use and should not be 
used. 


5. DX register always holds component and stepping identifier (see 
Section Component and Revision Identifiers). EAX register holds 
self-test signature if self-test was requested (see Section Self- 
Test Signature). 


Testability 
Self-Test 


The Am386DX/DXL microprocessor has the capability 
to perform a self-test. The self-test checks the function 
of all the Control ROM and most of the non-random logic 
of the part. Approximately one-half of the Am386DX/ 
DXL microprocessor can be tested during self-test. 


Self-Test is initiated on the Am386DX/DXL micropro- 
cessor when the RESET pin transitions from High to 
Low, andthe BUSY pin is Low. The self-test takes about 
2'° clocks or approximately 26 ms with a 20-MHz 
Am386DX/DXL device. At the completion of self-test, 
the processor performs reset and begins normal opera- 
tion. The part has successfully passed self-test if the 
contents of the EAX register are zero (0). If the results of 
EAX are not zero then the self-test has detected a flaw in 
the part. 


TLB Testing 


The Am386DX/DXL microprocessor provides a mecha- 
nism for testing the Translation Look-Aside Buffer (TLB) 





if desired. This particular mechanism is unique to the 
Am386DX/DXL CPU and may not be continued in the 
same way in future processors. When testing the TLB, 
paging must be turned off (PG = 0 in CRO) to enable the 
TLB testing hardware and avoid interference with the 
test data being written to the TLB. 


There are two TLB testing operations: 


1. Write entries into the TLB; and, 


2. Perform TLB lookups. Two test registers, shown in 
Figure 12, are provided for the purpose of testing. 
TR6 is the test command register and TR7 is the test 
data register. The fields within these registers are 
defined beiow. 

C: This is the command bit. For awrite into TR6 to cause 

an immediate write into the TLB entry, write a 0 to this 

bit. For a write into TR6 to cause an immediate TLB 
lookup, write a 1 to this bit. 


Linear Address: This is the tag field of the TLB .Ona 
TLB write, a TLB entry is allocated to this linear address 
and the rest of that TLB entry is set per the value of TR7 
and the value just written into TR6. On a TLB lookup, the 
TLB is interrogated per this value and if one and only 
one TLB entry matches, the rest of the fields of TR6 and 
TR7 are set from the matching TLB entry. 


Physical Address: This is the data field of the TLB. On 
a write to the TLB, the TLB entry allocated to the linear 
address in TR6 is set to this value. On a TLB lookup, the 
data field (physical address) from the TLB is read out to 
here. 


PL: Ona TLB write, PL = 1 causes the REP field of TR7 
to select which of four associative blocks of the TLB is to 
be written, but PL = 0 allows the internal pointer in the 
paging unit to select which TLB block is written. On a 
TLB lookup, the PL bit indicated whether the lookup was 
a hit (PL gets set to 1) or a miss (PL gets reset to 0). 


V: The valid bit for this TLB entry. All valid bits can also 
be cleared by writing to CR3. 


D, D: The dirty bit for/from the TLB entry. 
U, U: The user bit for/from the TLB entry. 
W, W: The writable bit for/from the TLB entry. 


For D, U, and W, both the attribute and its complement 
are provided as tag bits to permit the option of a don't 
care on TLB lookups. The meaning of these pairs of bits 
is given in the following table. 









Effect During Value of Bit 
TLB Lookup X after TLB Write 








Miss All 
Match if X=0 
| Match if X=1 
| Match All 


Bit X becomes undefined 
Bit X becomes 0 
| Bit X becomes 1 
| Bit X becomes undefined 







“~=-0O009o 
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For writing a TLB entry: 
1. Write TR7 for the desired physical address, PL, and 
REP values; and, 


2. Write TR6 with the appropriate linear address, etc., 
(be sure to write C = 0 for write command). 


For looking up (reading) a TLB entry: 


1. Write TR6 with the appropriate linear address (be 
sure to write C = 1 for lookup commana); and, 

2. Read TR7 and TRE. If the PL bit in TR7 indicates a 
hit, then the other values reveal the TLB contents. If 
PL indicates a miss, then the other values in TR7 and 
TR6 are indeterminate. 


Debugging Support 


The Am386DX/DXL microprocessor provides several 
features that simplify the debugging process. 
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The three categories of on-chip debugging aids are: 


1. The code execution breakpoint op-code (OCCH); 

2. The single-step capability provided by the TF bit in 
the flag register; and, 

3. The code and data breakpoint capability provided by 
the Debug Registers DR3—DRO, DR6, and DR7. 


Breakpoint Instruction 


A single-byte op-code breakpoint instruction is avail- 
able for use by software debuggers. The breakpoint op- 
code is OCCh and generates an Exception 3 trap when 
executed. In typical use, a debugger program can plant 
the breakpoint instruction at all desired code execution 
breakpoints. The single-byte breakpoint op-code is an 
alias for the two-byte general software interrupt instruc- 
tion, INT n, where n = 3. The only difference between 
INT 3 (OCCh) and INT n is that INT 3 is never lIOPL- 
sensitive; but, INT n is IOPL-sensitive in Protected 
Mode and Virtual 8086 Mode. 





12111 





Note: 0 indicates “Reserved for Future Use.” Do not define; see Section Compatibility. 


15021B—015 


Figure 12. Test Registers 
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Single-Step Trap 


If the single-step flag (TF, bit 8) in the EFLAGS register 
is found to be set at the end of an instruction, a single- 
step exception occurs. The single-step exception is auto 
vectored to Exception 1. Precisely, Exception 1 occurs 
as a trap after the instruction following the instruction 
that set TF. Intypical practice, a debugger sets the TF bit 
of a flag register image on the debugger’s stack. It then 
typically transfers control to the user program and loads 
the flag image with a signal instruction, the IRET instruc- 
tion. The single-step trap occurs after executing one in- 
struction of the user program. 


Since the Exception 1 occurs as a trap (that is, it occurs 
after the instruction has already executed), the CS:EIP 
pushed onto the debugger’s stack points to the next 
unexecuted instruction of the program being debugged. 
An Exception 1 handler, merely by ending with an IRET 
instruction, can therefore efficiently support single- 
stepping through a user program. 


Debug Registers 


The Debug Registers are an advanced debugging fea- 
ture of the Am386DX/DXL microprocessor. They allow 
data access breakpoints as well as code execution 
breakpoints. Since the breakpoints are indicated by on- 
chip registers, an instruction execution breakpoint can 
be placed in ROM code or in code shared by several 
tasks, neither of which can be supported by the INT 3 
breakpoint op-code. 


The Am386DX/DXL microprocessor contains six Debug 
Registers, providing the ability to specify up to four dis- 
tinct breakpoint addresses, breakpoint control options, 
and read breakpoint status. Initially after reset, break- 
points will occur unless the debug registers are pro- 
grammed. Breakpoints set up in the Debug Registers 
are auto-vectored to Exception 1. 


Linear Address Breakpoint Registers (DR3—DRO0) 


Up to four breakpoint addresses can be specified by 
writing into Debug Registers DR3—DRO, shown in Fig- 
ure 13. The breakpoint addresses specified are 32-bit 
linear addresses. AmM386DX/DXL microprocessor hard- 
ware continuously compares the linear breakpoint 





addresses in DR3—DRO with the linear addresses gen- 
erated by executing software (a linear address is the re- 
sult of computing the effective address and adding the 
32-bit segment base address). Note that if paging is not 
enabled the linear address equals the physical address. 
If paging is enabled, the linear address is translated to a 
physical 32-bit address by the on-chip paging unit. Re- 
gardless of whether paging is enabled or not, however, 
the breakpoint registers hold linear addresses. 


Debug Control Register (DR7) 


A Debug Control Register, DR7, shown in Figure 13, 
allows several debug control functions, such as ena- 
bling the breakpoints and setting up other control 
options for the breakpoints. The fields within the Debug 
Control Register, DR7, are as follows. 


LENi (Breakpoint Length Specification Bits) | 


A 2-bit LEN field exists for each of the four breakpoints. 
LEN specifies the length of the associated breakpoint 
field. The choices for data breakpoints are: 1 byte, 
2 bytes, and 4 bytes. Instruction execution break- 
points must have a length of 1 (LENi = 00). Encoding of 
the LENi field is as follows. 


Usage of Least 
Significant Bits in 
Breakpoint Address 
Register i, (i=0—3) 


LENi | Breakpoint 
Encoding Field Width 


1 byte All 32-bits used to specify 
a sng ect breakpoint 
field. 


2 bytes A31-—A1 used to specify 
a two-byte, word-aligned 
breakpoint field. AO in 
Breakpoint Address 
Register is not used. 


Undefined— 
do not use 


: 11 4 bytes | A31—A2 used to specify | 

| | afour-byte, Dword-aligned 
breakpoint field. AO and 

| A1 in Breakpoint Address | 
Register are not used. 
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Note: 0 indicates “Reserved for Future Use.” Do not define; see Section Compatibility. 
Figure 13. Debug Registers 15021B-016 


The LENi field controls the size of breakpoint field i by RWi (Memory Access Qualifier Bits) 
controlling whether all low-order linear address bits 
in the breakpoint address register are used to detect 
the breakpoint event. Therefore, all breakpoint fields 
are aligned; 2-byte breakpoint fields begin on Word 


A 2-bit RW field exists for each of the four breakpoints. 
The 2-bit RW field specifies the type of usage that must 
occur in order to activate the associated breakpoint. 


boundaries and 4-byte breakpoint fields begin on Dword RW Usage 
boundaries. Encoding Causing Breakpoint 
The following is an example of various size breakpoint 00 Instruction execution only 
fields. Assume the breakpoint linear address in DR2 is 01 Data writes only 


00000005H. In that situation, the following illustration 
indicates the region of the breakpoint field for lengths of 
1, 2, or 4 bytes. " 


10 Undefined—do not use this encoding 


Data reads and writes only 





DR2 =00000005H; LEN2=00B 


RW encoding 00 is used to set up an instruction execu- 
tion breakpoint. RW encodings 01 or 11 are used to set 


up write-only or read/write data breakpoints. 
00000008H 


Note that instruction execution breakpoints are taken 
sooso004n as faults (i.e., before the instruction executes), but 
00000000H data breakpoints are taken as traps (i.e., after the data 
transfer takes place). 





DR2=00000005H: LEN2=01B Using LENi and RWi to Set Data Breakpoint i 


A data breakpoint can be set up by writing the linear 
address into DRi (i = 0-3). For data breakpoints, RWi 


00000008H can = 01 (write only) or 11 (write/read). LEN can = 00, 
00000004H 01, or 11. 
00000000H If a data access falls entirely or partly within the data 





breakpoint field, the data breakpoint condition has oc- 
curred, and if the breakpoint is enabled, an Exception 1 









DR2=00000005H; LEN2=11B trap will occur. 
31 0 : ‘ 
Using LENi and RWi to Set Instruction Execution 
00000008H Breakpoint i 
An instruction execution breakpoint can be set up 
pela Sica rea by writing address of the beginning of the instruction 
ae ed ee 00000000H ~— (including prefixes if any) into DRi (i=0-3). RWi 


Am386DX/DXL Microprocessor Data Sheet 37 








at AMD 


must=00 and LEN must= 00 for instruction execution 
breakpoints. 


If the instruction beginning at the breakpoint address is 
about to be executed, the instruction execution break- 
point condition has occurred, and if the breakpoint is 
enabled, an Exception 1 fault will occur before the in- 
struction is executed. 


Note that an instruction execution breakpoint address 
must be equal to the beginning byte address of an in- 
struction (including prefixes) in order for the instruction 
execution breakpoint to occur. 


GD (Global Debug Register Access Detect) 


The Debug Registers can only be accessed in Real 
Mode or at privilege level 0 in Protected Mode. The GD 
bit, when set, provides extra protection against any De- 
bug Register access even in Real Mode or at privilege 
level 0 in Protected Mode. This additional protection fea- 
ture is provided to guarantee that a software debugger 
(or ICE-386) can have full control over the Debug Regis- 
ter resources when required. The GD bit, when set, 
causes an Exception 1 fault if an instruction attempts to 
read or write any Debug Register. The GD bit is then 
automatically cleared when the Exception 1 handler is 
invoked, allowing the Exception 1 handler free access to 
the debug registers. 


GE and LE (Exact Data Breakpoint Match, Global 
and Local) 


If either GE or LE is set, any data breakpoint trap will be 
reported exactly after completion of the instruction that 
caused the operand transfer. Exact reporting is pro- 
vided by forcing the Am386DX/DXL microprocessor 
execution unit to wait for completion of data oper- 
and transfers before beginning execution of the next 
instruction. 


If exact data breakpoint match is not selected, data 
breakpoints may not be reported until several instruc- 
tions later or may not be reported at all. When enabling a 
data breakpoint, it is therefore recommended to enable 
the exact data breakpoint match. 


When the Am386DX/DXL microprocessor performs a 
task switch, the LE bit is cleared. Thus, the LE bit sup- 
ports fast task switching out of tasks that have enabled 
the exact data breakpoint match for their task-local 
breakpoints. The LE bit is cleared by the processor dur- 
ing a task switch to avoid having exact data breakpoint 
match enabled in the new task. Note that exact data 
breakpoint match must be re-enabled under software 
control. 


The Am386DX/DXL microprocessor GE bit is unaf- 
fected during a task switch. The GE bit supports exact 
data breakpoint match that is to remain enabled during 
all tasks executing in the system. 


Note that instruction execution breakpoints are always 
reported exactly, whether or not exact data breakpoint 
match is selected. 


Gi and Li (Breakpoint Enable, Global and Local) 


If either Gior Liis set, then the associated breakpoint (as 
defined by the linear address in DRi, the length in LENi 
and the usage criteria in RWi) is enabled. If either Gi or 
Liis set and the Am386DX/DXL microprocessor detects 
the breakpoint condition, then the Exception 1 handler 
is invoked. 


When the Am386DX/DXL microprocessor performs a 
task switch to a new Task State Segment (TSS), all Li 
bits are cleared. Thus, the Li bits support fast task 
Switching out of tasks that use some task-local break- 
point registers. The Li bits are cleared by the processor 
during a task switch to avoid spurious exceptions in the 
new task. Note that the breakpoints must be enabled un- 
der software control. 


All Am386DX/DXL microprocessor Gi bits are unaf- 
fected during a task switch. The Gi bits support break- 
points that are active in all tasks executing inthe system. 


Debug Status Register (DR6) 


A Debug Status Register, DR6, shown in Figure 13, 
allows the Exception 1 handler to easily determine why 
it was invoked. Note the Exception 1 handler can be 
invoked as a result of one of several events. 


1. DRO Breakpoint fault/trap. 

. DR1 Breakpoint fault/trap. 

. DR2 Breakpoint fault/trap. 

. DR3 Breakpoint fault/trap. 

Single-step (TF) trap. 

Task switch trap. 

Fault due to attempted debug register access when 
GD = 1. 


The Debug Status Register contains single-bit flags for 
each of the possible events invoking Exception 1. Note 
below that some of these events are faults (exception 
taken before the instruction is executed), while other 
events are traps (exception taken after the debug 
events occurred). 


NOOR ON 


The flags in DR6 are set by the hardware but never 
cleared by hardware. Exception 1 handler software 
should clear DR6 before returning to the user program 
to avoid future confusion in identifying the source of 
Exception 1. 


The fields within the Debug Status Register, DR6 are as 
follows. 


Bi (Debug Fault/Trap Due to Breakpoint 0—3) 


Four breakpoint indicator flags, B3-B0, correspond 
one-to-one with the breakpoint registers in DR3—DRO. A 
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flag Bi is set when the condition described by DRi, LENi, 
and RWi occurs. 


If Gi or Li is set, and if the breakpoint is detected, the 
processor will invoke the Exception 1 handler. The ex- 
ception is handled as a fault if an instruction execution 
breakpoint occurred or as a trap if a data breakpoint 
occurred. 


Important Note: A flag, Bi, is set whenever the hard- 
ware detects a match condition on enabled breakpointi. 
Whenever a match is detected on at least one enabled 
breakpoint i, the hardware immediately sets all Bi bits 
corresponding to breakpoint conditions matching at that 
instant, whether enabled or not. Therefore, the Excep- 
tion 1 handler may see that multiple Bi bits are set, but 
only set Bi bits corresponding to enabled breakpoints (Li 
or Gi set) are true indications of why the Exception 1 
handler was invoked. 


BD (Debug Fault Due to Attempted Register Access 
When GD Bit Set) 


This bit is set if the Exception 1 handler was invoked due 
to an instruction attempting to read or write to the debug 
registers when GD bit was set. If such an event occurs, 
then the GD bit is automatically cleared when the Ex- 
ception 1 handler is invoked, allowing handler access to 
the debug registers. 


BS (Debug Trap Due to Single-Step) 
This bit is set if the Exception 1 handler was invoked due 


to the TF bit in the flag register being set (for single- 
stepping). See Section Single-Step Trap. 


BT (Debug Trap Due to Task Switch) 


This bit is set if the Exception 1 handler was invoked 
due to a task switch occurring to a task having an 
Am386DX/DXL microprocessor TSS with the T-bit set. 










Memory Operand 
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(See Figure 29.) Note the task switch into the new task 
occurs normally, but before the first instruction of the 
task is executed, the Exception 1 handler is invoked. 
With respect to the task switch operation, the operation 
is considered to be a trap. 


Use of Resume Flag (RF) in Flag Register 


The Resume Flag (RF) in the flag word can suppress an 
instruction execution breakpoint when the Exception 1 
handler returns to a user program at a user address that 
is also an instruction execution breakpoint. See Section 
Flags Register. 


REAL MODE ARCHITECTURE 
Real Mode Introduction 


When the processor is reset or powered up, it is initial- 
ized in Real Mode. Real Mode has the same base archi- 
tecture as the 8086, but allows access to the 32-bit 
register set of the Am386DX/DXL microprocessor. The 
addressing mechanism, memory size, and interrupt 
handling are all identical to the Reali Mode onthe 80286. 


All of the Am386DX/DXL microprocessor instructions 
are available in Real Mode (except those instructions 
listed in Protection and I/O Permission Bitmap). The de- 
fault operand size in Real Mode is 16 bits, just like the 
8086. in order to use the 32-bit registers and addressing 
modes, override prefixes must be used. In addition, the 
segment size on the AmM386DX/DXL CPU in Real Mode 
is 64 Kb so 32-bit effective addresses must have a value 
less than OOOOFFFFH. The primary purpose of Real 
Mode is to set up the processor for Protected Mode 
Operation. 


Max Limit 
Fixed At 64K In 
Real Mode 






Selected 
Segment 
Segment Base 
15021B—017 


Figure 14. Real Address Mode Addressing 
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LOCK Operation 


The LOCK prefix on the Am386DX/DXL microproces- 
sor, even in Real Mode, is more restrictive than on the 
80286. This is due to the addition of paging on the 
Am386DX/DXL CPU in Protected Mode and Virtual 
8086 Mode. Paging makes it impossible to guarantee 
that repeated string instructions can be LOCKed. The 
Am386DX/DXL CPU cannot require that all pages hold- 
ing the string be physically present in memory. Hence, a 
Page Fault (Exception 14) might have to be taken during 
the repeated string instruction. Therefore the LOCK 
prefix cannot be supported during repeated string 
instructions. 


These are the only instruction forms where the LOCK 
prefix is legal on the Am386DX/DXL microprocessor. 


Operands | 
Opcode (Dest, Source) 


IBIT TEST and | Mem, Reg/immed 
SET/RESET/COMPLEMENT | 














| Reg, Mem 
| Mem, Reg 
|ADD, OR, ADC, SBB, AND, SUB, XOR| Mem, Reg/immed 
NOT, NEG, INC, DEC 












Mem 





An Exception 6 will be generated if a LOCK prefix is 
placed before any instruction form or op-code not listed 
above. The LOCK prefix allows indivisible read/modify/ 
write operations on memory operands using the instruc- 
tions above. For example, even the ADD Reg, Mem is 
not LOCKable, because the Mem operand is not the 
destination (and therefore no memory read/modify/ 
operation is being performed). 


Since, onthe Am386DX/DXL microprocessor, repeated 
string instructions are not LOCKable, it is not possible 
to LOCK the bus for a long period of time. Therefore, the 
LOCK prefix is not |OPL-sensitive on the Am386DX/ 
DXL device. The LOCK prefix can be used at any privi- 
lege level, but only on the instruction forms listed above. 


Memory Addressing 


In Real Mode, the maximum memory size is limited to 
1 Mb. Thus, only address lines A19—A2 are active. 


Exception, the High address lines A31-A20 are 
High during CS-relative memory cycles until an inter- 
segment jump or call is executed (See Section Reset 
and Initialization). 


Since paging is not allowed in Real Mode, the linear ad- 
dresses are the same as physical addresses. Physical 
addresses are formed in Real Mode by adding the 
contents of the appropriate segment register that is 
shifted left by 4 bits to an effective address. This addition 
results in a physical address from O0O000000H to 
0010FFEFH. This is compatible with 80286 Real Mode. 
Since segment registers are shifted left by 4 bits, this im- 
plies that Real Mode segments always start on 16-byte 
boundaries. 


Ali segments in Real Mode are exactly 64-Kb long and 
may be read, written, or executed. The AmM386DX/DXL 
microprocessor will generate an Exception 13 if a data 
operand or instruction fetch occurs past the end of a 
segment (i.e., if an operand has an offset greater than 
FFFFH; for example, a word with a low byte at FFFFH 
and the high byte at O000H). 


segments may be overlapped in Real Mode. Thus, if a 
particular segment does not use all 64 Kb, another seg- 
ment c an be overlayed on top of the unused portion of 
the previous segment. This allows the programmer to 
minimize the amount of physical memory needed for a 
program. 


Reserved Locations 


There are two fixed areas in memory that are reserved in 
Real address mode: system initialization area and the 
interrupt table area. Locations 00000H through 003FFH 
are reserved for interrupt vectors. Each one of the 256 
possible interrupts has a 4-byte jump vector reserved 
for it. Locations FFFFFFFOH through FFFFFFFFH are 
reserved for system initialization. 


Interrupts 


Many of the exceptions shown in Table 5 and discussed 
in Section Interrupts are not applicable to Real Mode op- 
eration; in particular, Exceptions 10, 11, and 14 will not 
happen in Real Mode. Other exceptions have slightly 
different meanings in Real Mode. Table 8 identifies 
these exceptions. 


Table 8. Other Exceptions in Real Mode 


Interrupt 
Number Related Instructions Return Address Location 


Interrupt table limit too small a INT Vector is not within table limit. Before Instruction 


| CS, DS, ES, FS, GS 
Segment overrun exception 


Word memory reference 
beyond offset = FFFFH. 
An attempt to execute 


Before Instruction 


past the end of CS segment. 


[ecoreronemmin| ve | SSR, | __ oe min 
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Shutdown and Halt 


The HLT instruction stops program execution and 
prevents the processor from using the local bus until 
restarted. Either NMI, FLT, INTR with interrupts en- 
abled (IF=1), or RESET will force the Am386DX/DXL 
microprocessor out of halt. If interrupted, the saved 
CS:IP will point to the next instruction after the HLT. 


Shutdown willoccur when a severe error is detected that 
prevents further processing. In Real Mode, shutdown 
can occur under two conditions: 


e An interrupt or an exception occur (Exception 8 or 
13) and the interrupt vector is larger than the 
Interrupt Descriptor Table (i.e., there is not an 
interrupt handler for the interrupt); 


e ACALL, INT, or PUSH instruction attempts to wrap 
around the stack segment when SP is not even (e.g., 
pushing a value on the stack when SP = 0001 
resulting in a stack segment greater than FFFFH). 


An NMI input can bring the processor out of shutdown if 
the Interrupt Descriptor Table limit is large enough to 
contain the NMI interrupt vector (at least 0017H) andthe 
stack has enough room to contain the vector and flag in- 
formation (i.e., SP is greater than 0005H). Otherwise 
shutdown can only be exited via the RESET input. 


PROTECTED MODE ARCHITECTURE 
Introduction . 


The complete capabilities of the Am386DX/DXL micro- 
processor are unlocked when the processor operates in 
Protected Virtual Address Mode (Protected Mode). 
Protected Mode vastly increases the linear address 
space to 4 Gb (2% bytes) and allows the running of vir- 
tual memory programs of almost unlimited size (64 tb or 
2*° bytes). In addition, Protected Mode allows the 
Am386DX/DXL CPU to run all of the existing 8086 and 
80286 software, while providing a sophisticated mem- 
ory management and a hardware-assisted protection 
mechanism. Protected Mode allows the use of addi- 
tional instructions especially optimized for supporting 
multitasking operating systems. The base architecture 
of the Am3886DX/DXL CPU remains the same; the regis- 
ters, instructions, and addressing modes described in 
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the previous sections are retained. The main differ- 
ences between Protected Mode and Reai Mode from a 
programmer's view is the increased address space and 
a different addressing mechanism. 


Addressing Mechanism 


Like Real Mode, Protected Mode uses two components 
to form the logical address: a 16-bit selector is used to 
determine the linear base address of a segment; the 
base address is added to a 32-bit effective address to 
form a 32-bit linear address. The linear address is then 
either used as the 32-bit physical address or if paging is 
enabled the paging mechanism maps the 32-bit linear 
address into a 32-bit physical address. 


The difference between the two modes lies in calculat- 
ing the base address. In Protected Mode, the selector is 
used to specify an index into an operating system de- 
fined table (see Figure 15). The table contains the 32-bit 
base address of a given segment. The physical address 
is formed by adding the base address obtained from the 
table to the offset. 


Paging provides an additional memory management 
mechanism that operates only in Protected Mode. Pag- 
ing provides a means of managing the very large seg- 
ments of the Am386DX/DXL microprocessor. As such, 
paging operates beneath segmentation. The paging 
mechanism translates the protected linear address that 
comes from the segmentation unit into a physical ad- 
dress. Figure 16 shows the complete Am386DX/DXL 
device addressing mechanism with paging enabled. 


Segmentation 
Segmentation Introduction 


Segmentation is one method of memory management 
and provides the basis for protection. Segments are 
used to encapsulate regions of memory that have com- 
mon attributes. For example, all of the code of a given 
program could be contained in a segment or an operat- 
ing system table may reside in a segment. All informa- 
tion about a segment is stored in an 8-byte data struc- 
ture called a descriptor. Allofthe descriptors inasystem 
are contained in tables recognized by hardware. 
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Figure 16. Paging and Segmentation 
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Terminology 


The following terms are used throughout the discussion 
of descriptors, privilege levels, and protection: 


PL: Privilege Level—One of the four hierarchical privi- 
lege levels. Level 0 is the most privileged level and level 
3 is the least privileged. More privileged levels are nu- 
merically smaller than less privileged levels. 


RPL: Requester Privilege Level—The privilege level of 
the original supplier of the selector. RPL is determined 
by the least two significant bits of a selector. 


DPL: Descriptor Privilege Level—This is the least privi- 
leged level at which a task may access that descriptor 
(and the segment associated with that descriptor). De- 
scriptor Privilege Level is determined by bits 6—5 in the 
Access Right Byte of a descriptor. 


CPL: Current Privilege Level—The privilege level at 
which a task is currently executing, which equals the 
privilege level of the code segment being executed. CPL 
can also be determined by examining the lowest 2 bits of 
the CS register, except for conforming code segments. 


EPL: Effective Privilege Level—The effective privilege 
level is the least privileged of the RPL and DPL. Since 
small privilege level values indicate greater privilege, 
EPL is the numerical maximum of RPL and DPL. 


Task: One instance of the execution of a program. 
Tasks are also referred to as processes. 


Descriptor Tables 
Descriptor Tables Introduction 


The descriptor tables define all of the segments which 
are used in an Am386DX/DXL microprocessor system. 
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There are three types of tables on the Am386DX/DXL 
microprocessor that hold descriptors: the Global De- 
scriptor Table, Local Descriptor Table, and the Interrupt 
Descriptor Table. All of the tables are variable length 
memory arrays. They can range in size between 8 bytes 
and 64 Kb. Each table can hold up to 8192 eight byte 
descriptors. The upper 13 bits of a selector are used as 
an index into the descriptor table. The tables have 
registers associated with them that hold the 32-bit 
linear base address, and the 16-bit limit of each tabie. 


Each of the tables has a register associated with it: the 
GDTR, LDTR, andthe IDTR (see Figure 17). The LGDT, 
LLDT, and LIDT instructions load the base and limit of 
the Global, Local, and Interrupt Descriptor Tables, re- 
spectively, into the appropriate register. The SGDT, 
SLDT, and SIDT instructions store the base and limit 
values. These tables are manipulated by the operating 
system. Therefore, the load descriptor table instructions 
are privileged instructions. 


Global Descriptor Table 


The Global Descriptor Table (GDT) contains descriptors 
that are possibly available to all of the tasks ina system. 
The GDT can contain any type of segment descriptor 
except for descriptors that are used for servicing inter- 
rupts (i.e., interrupt and trap descriptors). Every 
Am386DX/DXL microprocessor contains a GDT. Gen- 
erally, the GDT contains code and data segments used 
by the operating systems and task state segments and 
descriptors for the LDTs in a system. 


The first slot of the Global Descriptor Table corresponds 
to the null selector and is not used. The null selector 
defines a null pointer value. 


31 0 


Program Invisible 
Automatically Loaded 
From LDT Descriptor 
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Figure 17. Descriptor Table Registers 
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Local Descriptor Table 


LDTs contain descriptors that are associated with a 
given task. Generally, operating systems are designed 
so that each task has a separate LDT. The LDT may 
contain only code, data, stack, task gate, and call gate 
descriptors. LDTs provide a mechanism for isolating a 
given task’s code and data segments from the rest of the 
operating system, while the GDT contains descriptors 
for segments that are common to all tasks. A segment 
cannot be accessed by a task if its segment descriptor 
does not exist in either the current LDT or the GDT. This 
provides both isolation and protection for a task’s seg- 
ments, while still allowing global data to be shared 
among tasks. 


Unlike the 6-byte GDT or IDT registers that contain a 
base address and limit, the visible portion of the LDT 
register contains only a 16-bit selector. This selector re- 
fers to a Local Descriptor Table descriptor in the GDT. 


Interrupt Descriptor Table 


The third table needed for AM386DX/DXL microproces- 
sor systems is the Interrupt Descriptor Table (see Figure 
18). The IDT contains the descriptors that point to the lo- 
cation of up to 256 interrupt service routines. The IDT 
may contain only task gates, interrupt gates, and trap 
gates. The IDT should be at least 256 bytes in size in 






IDT Limit hd 
IDT Base 












order to hold the descriptors for the 32, Reserved for 
Future Use, interrupts. Every interrupt used by asystem 
must have an entry inthe IDT. The IDT entries are refer- 
enced via INT instructions, external interrupt vectors, 
and exceptions. (See Interrupts.) 


Descriptors 
Descriptor Attribute Bits 


The object to which the segment selector points is called 
a descriptor. Descriptors are 8-byte quantities that con- 
tain attributes about a given region of linear address 
space (i.e., a segment). These attributes include the 
32-bit base linear address of the segment, the 20-bit 
length and granularity of the segment, the protection 
level, read, write or execute privileges, the default size 
of the operands (16 bit or 32 bit), and the type of seg- 
ment. All of the attribute information about a segment is 
contained in 12 bits in the segment descriptor. Figure 19 
shows the general format of a descriptor. All segments 
on the Am3886DX/DXL microprocessor have three at- 
tribute fields in common: the P bit, the DPL bit, andthe S 
bit. The Present P bit is 1 if the segment is loaded in 
physical memory; if P= 0 then any attemptto access this 
segment causes a not present exception (Exception 
11). The Descriptor Privilege Level (DPL) is a 2-bit field 
that specifies the protection levels 0-3 associated witha 
segment. 
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Figure 18. Interrupt Descriptor Table Register Use 
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Segment Base 15-0 


Base Base Address of the segment 

Limit | The length of the segment 

P Present Bit: 1=Present, 0 = Not Present 
DPL Descriptor Privilege Levels 0-3 
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Byte 
0 Address 


Segment Limit 15—0 0 





bu DPL Type 
= Limit Base 
ewosrae  |ololof any se [LP ]S1 1 [4] Bet] ~ 


S Segment Descriptor: 0 = System Descriptor, 1 = Code or Data Segment Descriptor 

Type Type of Segment 

A Accessed Bit 

G Granularity Bit: 1 =Segment length is page granular, O= Segment length is byte granular 

D Default Operation Size (recognized in code segment descriptors only): 1 =32-bit segment, 0 = 16-bit segment 


Bit must be zero (0) for compatibility with future processors 


0 
AVL Available field for user or OS 


Note: In a maximum-size segment (i.e., segment with G = 1 and segment limit 19-0 = FFFFFH), the lowest 12 bits of 
the segment base should be zero (i.e., segment base 11-000 = 000H). 
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Figure 19. General Format of Segment Descriptors 


The Am386DX/DXL microprocessor has two main cate- 
gories of segments: system segments and non-system 
segments (for code and data). The segment S bit in the 
segment descriptor determines if a given segment is a 
system segment or acode or data segment. If the S bit is 
1, then the segment is either a code or data segment; if it 
is 0, then the segment is a system segment. 


Am386DX/DXL Microprocessor Code and Data 
Descriptors (S = 1) 


Figure 20 shows the general format of a code and data 
descriptor and Table 9 illustrates how the bits in the 
Access Rights Byte are interpreted. 


Code and data segments have several descriptor fields 
in common. The accessed A bit is set whenever the 
processor accesses a descriptor. The A bit is used 
by operating systems to keep usage statistics on a 
given segment. The G bit, or granularity bit, specifies if 
a segment length is byte-granular or page-granular. 


Am386DX/DXL microprocessor segments can be 1 Mb. 


long with byte granularity (G=0) or 4 Gb with page 
granularity (G= 1), (i.e., 22° pages—each page is 4 Kb 
in length). The granularity is totally unrelated to paging. 
An Am3886DX/DXL CPU system can consist of seg- 
ments with byte granularity and page grannlay, 
whether or not paging is enabled. 


The executable E bit tells if a segment is a code or data 
segment. A code segment (E=1, S=1) may be exe- 
cute-only or execute/read as determined by the Read 
R bit. Code segments are execute only if R= 0 and exe- 
cute/read if R =1. Code segments may never be written 
into. 


Note: Code segments may be modified via aliases. Aliases 
are writeable data segments that occupy the same range of 
linear address space as the code segment. 


The D bit indicates the default length for operands and 
effective addresses. If D = 1, then 32-bit operands 
and 32-bit addressing modes are assumed. If D = 0, 
then 16-bit operands and 16-bit addressing modes are 
assumed. Therefore all existing 80286 code segments 
will execute on the Am386DX/DXL microprocessor 
assuming the D bit is set 0. 


Another attribute of code segments is determined by the 
conforming C bit. Conforming segments, C = 1, can be 
executed and shared by programs at different privilege 
levels (see Section Protection). 
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Segment Base 15-0 


Segment Limit 15—0 0 


imi Access Rights Base 


D/B 1 = Default Instructions Attributes are 32 bits 
0 = Default Instructions Attributes are 16 bits 
AVL Available field for user or OS 
G Granularity Bit: 1 =Segment length is page granular, 0= Segment length is byte granular 
0 Bit must be zero (0) for compatibility with future processors 





Note: in a maximum-size segment (i.e., a segment with G= 1 and segment limit 19-0 = FFFFFH), the lowest 12 bits of 
the segment base should be zero (i.e., segment base 11-000 = 000H). 
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Figure 20. Code and Data Segment Descriptors 


Table 9. Access Rights Byte Definition for Code and Data Descriptions 


Bit 
| Position | 


Present (P) Segment is mapped into physical memory. 

No mapping to physical memory exists, base and limit are 
not used. 

Descriptor Privilege Segment privilege attribute used in privilege tests. 
Levels (DPL) 

Segment Descriptor (S) Code or Data (includes stacks) segment descriptor. 


System Segment Descriptor or Gate Descriptor. 


nn 
WoW 
oOo 


Descriptor type is data segment. 

Expand up segment, offsets must be < limit. 
Expand down segment, offsets must be > limit. 
Data segment may not be written into. S=1, 
Data segment may be written into. E=0) 


If Data 
Segment 


mmm 
220i 

i to 

ao) 


— © 


Executable (E) 
Conforming (C) 


Descriptor type is code segment. 

Code segment may only be executed when If Code 
CPL2=DPL and CPL remains unchanged. Segment 
Code segment may not be read. (S=1, 
Code segment may be read. E=1) 


Readable (R) 


Accessed (A) Segment has not been accessed. 
Segment selector has been loaded into segment register 


or used by selector test instructions. 


Pr); vad om 





vi 
6-5 | 
4 
3 Executable (E) 
2 Expansion Direction (ED) 
1 Writeable (W) 
3 
| 2 
1 


Segments identified as data segments (E=0, S=1) are 
used for two types of Am3886DX/DXL microprocessor 
segments: stack and data segments. The expansion 
direction (ED) bit specifies if a segment expands down- 
ward (stack) or upward (data). If a segment is a stack 
segment, all offsets must be greater than the segment 
limit. On a data segment all offsets must be less than or 
equal to the limit. In other words, stack segments start at 
the base linear address plus the maximum segment limit 
and grow down to the base linear address plus the limit. 
On the other hand, data segments start at the base 
linear address and expand to the base linear address 
plus limit. 


The write (W) bit controls the ability to write into a seg- 
ment. Data segments are read-only if W=0. The stack 
segment must have W = 1. 


The B bit controls the size of the stack pointer register. If 
B=1,thenPUSHes, POPs, and CALLs alluse the 32-bit 
ESP register for stack references and assume an upper 
limit of FFFFFFFFH. If B=0, stack instructions all use 
the 16-bit SP register and assume an upper limit of 
FFFFH. 


System Descriptor Formats 


System segments describe information about oper- 
ating system tables, tasks, and gates. Figure 21 shows 
the general format of system segment descriptors, and 
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the various types of system segments. The Am386DX/ 
DXL microprocessor system descriptors contain a 
32-bit base linear address and a 20-bit segment limit. 
80286 system descriptors have a 24-bit base address 
and a 16-bit segment limit. 80286 system descriptors 
are identified by the upper 16 bits being all zeros. 


LDT Descriptors (S=0, Type = 2) 


LDT descriptors (S=0, TYPE =2) contain information 
about Local Descriptor Tables. LDTs contain a table of 
segment descriptors, unique to a particular task. Since 
the instruction to load the LDTR is only available at privi- 
lege level 0, the DPL field is ignored. LDT descriptors 
are only allowed in the Global Descriptor Table (GDT). 


TSS Descriptors (S = 0, Type = 1, 3, 9, B) 


A Task State Segment (TSS) descriptor contains infor- 
mation about the location, size, and privilege level of a 
TSS. ATSS in turn is a special fixed format segment that 
contains all the state information for atask and a linkage 
field to permit nesting tasks. The Type field is used to in- 
dicate whether the task is currently BUSY (i.e., ona 
chain of active tasks) or the TSS is available. The Type 
field also indicates if the segment contains a 80286 or an 
Am386DX/DXL microprocessor TSS. The Task Regis- 
ter (TR) contains the selector that points to the current 
TSS. 


Gate Descriptors (S = 0, Type = 4-7, C, F) 


Gates are used to control access to entry points within 
the target code segment. The various types of gate de- 
scriptors are call gates, task gates, interrupt gates, and 
trap gates. Gates provide a level of indirection between 
the source and destination of the control transfer. This 
indirection allows the processor to automatically per- 
form protection checks. It also allows system designers 
to control entry points to the operating system. Call 
gates are used to change privilege levels (see Section 
Protection), task gates are used to perform a task 
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switch, and interrupt and trap gates are used to specify 
interrupt service routines. 


Figure 22 shows the format of the four types of gate de- 
scriptors. Call gates are primarily used to transfer pro- 
gram control to amore privileged level. The call gate de- 
scriptor consists of three fields: the access byte; a long 
pointer (selector and offset) that points to the start of a 
routine; and a word count that specifies how many pa- 
rameters are to be copied from the caller’s stack to the 
stack of the called routine. The word count field is only 
used by call gates when there is a change in the privi- 
lege level, other types of gates ignore the word count 
field. 


Interrupt and trap gates use the destination selector and 
destination offset fields of the gate descriptor as a point- 
er to the start of the interrupt or trap handler routines. 
The difference between interrupt gates and trap gates is 
that the interrupt gate disables interrupts (resets the IF 
bit) while the trap gate does not. 


Task gates are used to switch tasks. Task gates may 
only refer to a task state segment (see Section Task 
Switching); therefore, only the destination selector por- 
tion of atask gate descriptor is used, andthe destination 
offset is ignored. 


Exception 13 is generated when a destination selector 
does not refer to a correct descriptor type, i.e., a code 
segment for an interrupt, trap or call gate, a TSS fora 
task gate. 


The access byte format is the same for all gate descrip- 
tors. P=1 indicates that the gate contents are valid. 
P =O indicates the contents are not valid and causes Ex- 
ception 11 if referenced. DPL is the descriptor privilege 
level and specifies when this descriptor may be used by 
a task (see Section Protection). The S field, bit 4 of the 
access rights byte, must be 0 to indicate a system con- 
trol descriptor. The type field specifies the descriptor 
type as indicated in Figure 22. 
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Segment Limit 15-0 0 
DPL Type Base 
23-16 +4 





Type Definition 


Invalid 

Available Am386DX/DXL CPU TSS 
Undefined (Reserved) 

Busy Am386DX/DXL CPU TSS 
Am386DX/DXL CPU Call Gate 
Undefined (Reserved) 
Am386DX/DXL CPU Interrupt Gate — 
Am386DX/DXL CPU Trap Gate 
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Note: In amaximum-size segment (i.e., segment with G = 1 and segment limit 19-0 = FFFFFH), the lowest 12 bits 
of the segment base should be Zero (i.e., segment base 11-000 =000H). 
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Figure 21. System Segments Descriptors 
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Gate Descriptors Fields 


Name Value 
Type 4 
5 
6 
7 
C 
E 
F 
P 0 
1 


DPL| Word 






Offset 15-0 







Description 

80286 Call Gate 

Task Gate (for 80286 or Am386DX/DXL CPU Task) 
80286 Interrupt Gate 

80286 Trap Gate 

Am386DX/DXL CPU Call Gate 

Am386DX/DXL CPU Interrupt Gate 

Am386DX/DXL CPU Trap Gate 

Descriptor contents are not valid 

Descriptor contents are valid 


DPL—Least privileged level at which a task may access the gate. WORD COUNT 0-31—The number of parameters to copy 
from caller’s stack to the called procedure’s stack. The parameters are 32-bit quantities for Am386DX/DXL CPU gates, and 


16-bit quantities for 80286 gates. 


DESTINATION 16-Bit 
SELECTOR Selector 
DESTINATION Offset 
OFFSET 16-bit 80286 


32-bit AM386DX/DXL CPU 


Selector to the target code segment 
or 
Selector to the target state segment for task gate 


Entry point within the target code segment 
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Figure 22. Gate Descriptor Formats 


Difference Between Am386DX/DXL Microproces- 
sor and 80286 Descriptors 


In order to provide operating system compatibility be- 
tween the 80286 and Am386DX/DXL microprocessor, 
the Am386DX/DXL CPU supports all of the 80286 seg- 
ment descriptors. Figure 23 shows the general format of 
an 80286 system segment descriptor. The only differ- 
ences between 80286 and Am386DX/DXL device de- 
scriptor formats are that the values of the type fields and 
the limit and base address fields have been expanded 
for the Am3886DX/DXL device. The 80286 system seg- 
ment descriptors contained a 24-bit base address and 
16-bit limit, while the Am386DX/DXL microprocessor 
system segment descriptors have a 32-bit base ad- 
dress, a 20-bit limit field, and a granularity bit. 


By supporting 80286 system segments, the Am386DX/ 
DXL microprocessor is able to execute 80286 appli- 
cation programs on an Am386DX/DXL CPU operating 
system. This is possible because the processor 
automatically understands which descriptors are 
80286-style descriptors and which are Am386DX/DXL 
microprocessor-style descriptors. In particular, if the 
upper word of a descriptor is zero, then that descriptor 
is an 80286-style descriptor. 


The only other differences between 80286-style de- 
scriptors and Am3886DX/DXL microprocessor descrip- 
tors is the interpretation of the word count field of call 
gates and the B bit. The word count field specifies the 
number of 16-bit quantities to copy for 80286 call gates 
and 32-bit quantities for Am386DX/DXL device call 
gates. The B bit controls the size of PUSHes when using 
a call gate; if B = 0, then PUSHes are 16 bits, if B = 1, 
then PUSH¢es are 32 bits. 


Selector Fields 


A selector in Protected Mode has three fields: Local or 
Global Descriptor Table Indicator (Tl), Descriptor Entry 
Index (Index), and Requestor (the selector’s) Privilege 
Level (RPL) as shown in Figure 24. The TI bits select 
one of two memory-based tables of descriptors (the 
Global Descriptor Table or the Local Descriptor Table). 
The Index selects one of 8K descriptors in the appropri- 
ate descriptor table. The RPL bits allow high speed test- 
ing of the selector’s privilege attributes. 


Segment Descriptor Cache 


In addition to the selector value, every segment register 
has a segment descriptor cache register associated 
with it. Whenever a segment register’s contents are 


48 Am386 Microprocessors for Personal Computers 


changed, the 8-byte descriptor associated with that 
selector is automatically loaded (cached) on the chip. 
Once loaded, all references to that segment use the 
cached descriptor information instead of reaccessing 
the descriptor. The contents of the descriptor cache are 


—"" a 


| Selector Base 15-0 Base 15-0 
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not visible to the programmer. Since descriptor caches 
only change when a segment register is changed, 
programs that modify the descriptor tables must reload 
the appropriate segment registers after changing a 
descriptor’s value. 


Segment Limit 15—0 0 


R d f Fut U DP Type 
i eee 





Base Base Address of the Segment 

Limit The length of the Segment 

P Present Bit: 1 = Present, 0 = Not Present 
DPL Descriptor Privilege Levels 0-3 

S System Descriptor: 0 = System, 1 = User 
Type Type of Segment 
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Figure 23. 80286 Code and Data Segment Descriptors 
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Segment Descriptor Register Settings 


The contents of the segment descriptor cache vary de- 
pending on the operating mode of the Am386DX/DXL 
microprocessor. When operating in Real Address 
Mode, the segment base, limit, and other attributes 
within the segment cache registers are defined as 
shown in Figure 25. 


For compatibility with the 8086 architecture, the base is 
set to 16 times the current selector value, the limit is 
fixed at OOOOFFFFH, and the attributes are fixed to 


indicate that the segment is present and fully usable. In 
Real Address Mode, the internal privilege level is always 
fixed to the highest level, level 0, so I/O and other privi- 
leged op-codes may be executed. 


When operating in Protected Mode, the segment base, 
limit, and other attributes within the segment cache reg- 
isters are defined as shown in Figure 26. In Protected 
Mode, each of these fields are defined according to the 
contents of the segment descriptor indexed by the se- 
lector value loaded into the segment register. 


Segment Descriptor Cache Register Contents 


32-Bit Base 
(Updated During Selector 32-Bit Limit 
Load into Segment Register) (Fixed) 


Conforming Privilege 
Stack Size 
Executable 
Writeable 
Readable 
Expansion Direction 
Granularity 
Accessed 
Privilege Level 
Present — 


BASE LIMIT 






CS | 16X Current CS Selector* | 
SS | 16X Current SS Selector 


OOOOFFFFH 


ES | 16X Current ES Selector OOOOFFFFH 


FS 16X Current FS Selector 
GS | 16X Current GS Selector 


OOOOFFFFH 


Key: Yes D 
No B 
Privilege level 0 P 
Privilege level 1 W 
Privilege level 2 F 
Privilege level 3 - 


Expand up 


OOOOFFEFH 
DS | 16X Current DS Selector OOOOFFFFH 


C OOOOFFFFH 


Other Attributes 
(Fixed) 















Expand down 

Byte granularity 

Page granularity 

Push/pop 16-bit words 

Push/pop 32-bit Dwords 

Does not apply to that segment cache register 


*Except the 32-bit CS base is initialized to FFFFFOOOH after reset until first intersegment control transfer (e.g., intersegment CALL, or 


intersegment JMP, or INT). (See Figure 27 example.) 
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Figure 25. Segment Descriptor Caches for Real Address Mode 
(Segment Limit and Attributes are Fixed) 
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Segment Descriptor Cache Register Contents 


Other Attributes 
(Updated During Selector 
Load Into Segment Register) 


32-Bit Base 
(Updated During Selector 
Load into Segment Register) 


32-Bit Limit 
(Updated During Selector 
Load Into Segment Register) 


Conforming Privilege 
Stack Size 
Executable 
Writeable 
Readable 
Expansion Direction 





Granularity 





Accessed 
Privilege Level 


Present 
BASE LIMIT I 


| Base per Seg Descr Limit per Seg Descr 


Base per Seg Descr | Limit perSeg Descr | 
Base per Seg Descr Limit per Seg Descr | 


Base per Seg Descr Limit per Seg Descr 
Base per Seg Descr Limit per Seg Descr 


Base per Seg Descr Limit per Seg Descr 





Fixed Yes 

Fixed No 

Per segment descriptor 

Per segment descriptor; descriptor must indicate “present” to avoid Exception 11 (Exception 12 in case of SS) 
Per segment descriptor, but descriptor must indicate “readable” to avoid Exception 13 (special case for SS) 
Per segment descriptor, but descriptor must indicate “writeable” to avoid Exception 13 (special case for SS) 
Does not apply to that segment cache register 
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Figure 26. Segment Descriptor Caches for Protected Mode (Loaded per Descriptor) 


When operating in a Virtual 8086 Mode within the Pro- 
tected Mode, the segment base, limit, and other attrib- 
utes within the segment cache registers are defined 
as shown in Figure 27. For compatibility with the 8086 
architecture, the base is set to 16 times the current 
selector value, the limit is fixed at OOOOFFFFH, and the 


attributes are fixed so as to indicate the segment 
is present and fully usable. The virtual program exe- 
cutes at lowest privilege level, level 3, to allow trapping 
of all |OPL-sensitive instructions and level 0 only 
instructions. 
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Segment Descriptor Cache Register Contents 


fdisseta oaareie sacs 32-Bit Limit Other Attributes 
Load into Segment Register) (Fixed) (Fixed) 
Conforming Privilege 
Stack Size 
Executable 
Writeable 
Readable 





Expansion Direction 
Granularity 





Accessed 
Privilege Level 


Present 
BASE LIMIT i 












16X Current CS Selector OOOOFFFFH 


Y 
Kz 
sLy 
cy 






16X Current ES Selector OOOOFFFFH | 
16X Current FS Selector OOOOFFFFH | 


Y = Yes D = Expand down 

N = No B = Byte granularity 

0 = Privilege level 0 P = Page granularity 

1 = Privilege level 1 W = Push/pop 16-bit words 

2 = Privilege level 2 F = Push/pop 32-bit Dwords 

3 = Privilege level 3 ~— = Does not apply to that segment cache register 
U = Expand up 
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Figure 27. Segment Caches for Virtual 8086 Mode within Protected Mode 
(Segment Limit and Attributes are Fixed) 
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_ Protection 
Protection Concepts 


The Am386DX/DXL microprocessor has four levels of 
protection that are optimized to support the needs of a 
multitasking operating system to isolate and protect 
user programs from each other and the operating sys- 
tem. The privilege levels control the use of privileged in- 
structions, I/O instructions, and access to segments and 
segment descriptors. Unlike traditional microprocessor 
based systems where this protection is achieved only 
through the use of complex external hardware and soft- 
ware, the Am386DX/DXL CPU provides the protection 
on a page basis when paging is enabled (see Section 
Page Level Protection). 


The four-level hierarchical privilege system is illustrated 
in Figure 28. It is an extension of the user/supervisor 
privilege mode commonly used by minicomputers and, 
in fact, the user/supervisor mode is fully supported by 
the Am386DX/DXL microprocessor paging mechanism. 
The privilege levels (PL) are numbered 0 through 3. 
Level 0 is the most privileged or trusted level. 


CPU 
Enforced 
Software 
Interfaces 





Applications 






Kernel 
PL=0 
Most 
Privileged 









High Speed 
Operating 
System 


Interface 15021B-031 


Figure 28. Four-Level Hierarchical Protection 


Rules of Privilege 


The Am3886DX/DXL microprocessor controls access to 
both data and procedures between levels of a task, ac- 
cording to the following rules. 


e Datastoredinasegment with privilege level p canbe 
accessed only by code executing at a privilege level 
at least as privileged as p. 

e Acode segment/procedure with privilege level p can 
only be called by a task executing at the same ora 
lesser privilege level than p. 
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Privilege Levels 
Task Privilege 


At any point in time, a task on the Am386DX/DXL micro- 
processor always executes at one of the four privilege 
levels. The Current Privilege Level (CPL) specifies the 
task’s privilege level. Atask’s CPL may only be changed 
by control transfers through gate descriptors to a code 
segment with a different privilege level (see Section 
Privilege Level Transfers). Thus, an application pro- 
gram running at PL=3 may call an operating system 
routine at PL = 1 (via a gate) that would cause the task’s 
CPL to be set to 1 until operating system routine is 
finished. 


Selector Privilege (RPL) 


The privilege level of a selector is specified by the RPL 
field. The RPL is the two least significant bits of the se- 
lector. The selector’s RPL is only used to establish a 
less trusted privilege level than the current privilege 
level for the use of a segment. This level is called the 
task’s effective privilege level (EPL). The EPL is defined 
as being the least privileged (i.e., numerically larger) 
level of a task’s CPL and a selector’s RPL. Thus, if se- 
lector’s RPL = 0, thenthe CPL always specifies the privi- 
lege level for making an access using the selector. On 
the other hand if RPL = 3, then a selector can only ac- 
cess segments at level! 3 regardless of the task’s CPL. 
The RPL is most commonly used to verify that pointers 
passed to an operating system procedure do not access 
data that is of higher privilege than the procedure that 
originated the pointer. Since the originator of a selector 
can specify any RPL value, the Adjust RPL (ARPL) in- 
Struction is provided to force the RPL bits to the 
originator’s CPL. 


l/O Privilege and I/O Permission Bitmap 


The I/O privilege level (IOPL, a 2-bit field inthe EFLAGS 
register) defines the least privileged level at which 
I/O instructions can be unconditionally performed. I/O 
instructions can be unconditionally performed when 
CPL< IOPL. (The I/O instructions are IN, OUT, INS, 
OUTS, REP INS, and REP OUTS.) When CPL>IOPL, 
and the current task is associated with a 286 TSS, at- 
tempted I/O instructions cause an Exception 13 fault. 
When CPL > IOPL, and the current task is associated 
with an Am3886DX/DXL CPU TSS, the I/O Permission 
Bitmap (part of an Am386DX/DXL microprocessor TSS) 
is consulted on whether I/O to the port is allowed, or an 
Exception 13 fault is to be generated instead. For dia- 
grams of the I/O Permission Bitmap, refer to Figures 
29a and 29b. For further information on how the I/O Per- 
mission Bitmap is used in Protected Mode or in Virtual 
8086 Mode, refer to Section Protection and I/O Permis- 
sion Bitmap. 
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3130 29 28 27 26 25 24 23 22 21 20 19 18 


31 | 
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I/O Ports Accessible: 2 > 9, 12, 13, 15, 20 > 24, 27, 33, 34, 40, 41, 48, 50, 52, 53, 58 —> 60, 62, 63, 96 + 127 
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Figure 29b. Sample I/O Permission Bit Map 


The I/O privilege level (IOPL) also affects whether 
several other instructions can be executed or cause an 
Exception 13 fault instead. These instructions are called 
lIOPL-sensitive instructions and they are CLI and STI. 
(Note that the LOCK prefix is not IOPL-sensitive on the 
Am386DX/DXL microprocessor.) 


The IOPL also affects whether the IF bit (interrupts en- 
able flag) can be changed by loading a value into the 
EFLAGS register. When CPL<IOPL, the IF bit can be 
changed by loading a new value into the EFLAGS regis- 
ter. When CPL > IOPL, the IF bit cannot be changed by a 
new value POP’ed into (or otherwise loaded into) the 
EFLAGS register; the IF bit merely remains unchanged 
and no exception is generated. 


Table 10. Pointer Test Instructions 


Instruction Operands Function 


ARPL Selector, 
Register 


Adjust Requested Privilege 
Level; adjusts the RPL of the 
selector to the numeric maximum 
of current selector RPL value and 
the RPL value in the register. Set 
zero flag if selector RPL was 
changed. 


VERR Selector | VERify for Read: sets the zero 
flag if the segment referred to 


by the selector can be read. 


VERify for Write: sets the zero 
flag if the segment referred to 
by the selector can be written. 


VERW Selector 


Register, 
Selector 


Load Segment Limit: reads the 
segment limit into the register if 
privilege rules and descriptor 
type allow. Set zero flag if 
successful. 


Register, 
Selector 


Load Access Rights: reads the 
descriptor access rights byte into 
the register if privilege rules allow. 
Set zero flag if successful. 





Privilege Validation 


The Am386DX/DXL CPU provides several instructions 
to speed pointer testing and help maintain system 
integrity by verifying that the selector value refers to an 


appropriate segment. Table 10 summarizes the selec- 
tor validation procedures available for the Am386DX/ 
DXL microprocessor. 


This pointer verification prevents the common problem 
of an application at PL = 3 calling an operating-systems 
routine at PL = 0 and passing the operating-systems 
routine a bad pointer that corrupts a data structure 
belonging to the operating system. If the operating- 
systems routine uses the ARPL instruction to ensure 
that the RPL of the selector has no greater privilege 
than that of the caller, then this problem can be avoided. 


Descriptor Access 


There are basically two types of segment accesses: 
those involving code segments, such as control trans- 
fers; and those involving data accesses. Determining 
the ability of a task to access a segment involves the 
type of segment to be accessed, the instruction used, 
the type of descriptor used, and CPL, RPL, and DPL as 
described above. 


Any time an instruction loads data segment registers 
(DS, ES, FS, GS) the Am386DX/DXL microprocessor 
makes protection validation checks. Selectors loaded in 
the DS, ES, FS, GS registers must refer only to data 
segments or readable code segments. The data access 
rules are specified in Section Rules of Privilege. The 
only exception to those rules is readable conforming 
code segments which can be accessed at any privilege 
level. 


Finally, the privilege validation checks are performed. 
The CPL is compared to the EPL; if the EPL is more 
privileged than the CPL, an Exception 13 (General Pro- 
tection fault) is generated. 


The rules regarding the stack segment are slightly differ- 
ent than those involving data segments. Instructions 
that load selectors into SS must refer to data segment 
descriptors for writeable data segments. The DPL and 
RPL must equal the CPL. All other descriptor types ora 
privilege level violation will cause Exception 13. A stack 
not present fault causes Exception 12. Note that an 
Exception 11 is used for a not-present code or data 
segment. 
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Table 11. Descriptor Types Used for Control Transfer 






Intersegment to the same or higher privilege level 











Interrupt within task may change CPL 


| Task Switch 


*NT (Nested Task bit of flag register) = 0 


Privilege Level Transfers 


Intersegment control transfers occur when a selector is 
loaded in the CS register. For a typical system most of 
these transfers are simply the result of a call or a jump to 
another routine. There are five types of control transfers, 
which are summarized in Table 11. 


Many of these transfers result in a privilege level trans- 
fer. Changing privilege levels is done only via control 
transfers by using gates, task switches, and interrupt or 
trap gates. 


Control transfers can only occur if the operation that 
loaded the selector references the correct descriptor 
type. Any violation of these descriptor usage rules will 
cause an Exception 13 (e.g., JMP through a call gate or 
IRET from a normal subroutine call). 


In order to provide further system security, all control 
transfers are also subject to the privilege rules. 


The privilege rules require that: 


— Privilege level transitions can only occur via gates. 


— JMPs can be made to a non-conforming code 
segment with the same privilege or to a conforming 
code segment with greater or equal privilege. 


— CALLs can be made to a non-conforming code 
segment with the same privilege or via a gate to a 
more privileged level. 


— Interrupts handled within the task obey the same 
privilege rules as CALLs. 


— Conforming Code segments are accessible by 
privilege levels that are the same or less privileged 
than the conforming-code segment’s DPL. 


— Both the requested privilege level (RPL) in the 
selector pointing to the gate and the task’s CPL must 
be of equal or greater privilege than the gate’s DPL. 


| Descriptor Descriptor} 
Control Transfer Types Operation Types Referenced Table 
Intersegment within the same privilege level JMP, CALL, RET, IRET* Code Segment GDT/LDT 
| CALL Call Gate GDT/LDT 


Interrupt Instruction, Trap or Interrupt 
Exception, External Interrupt | Gate IDT 
Intersegment to a lower privilege level (change task CPL) | RET, IRET* | Code Segment GDT/LDT 


CALL, JMP 


| IRET**, Interrupt Instruction, | | 
| Exception, External Interrupt | peck Gale jor 


**NT (Nested Task bit of flag register) = 1 











— The code segment selected in the gate must be the 
same or more privileged than the task’s CPL. 


— Return instructions that do not switch tasks can only 
return control to a code segment with same or less 
privilege. 

— Task switches can be performed by a CALL, JMP, or 
INT that references either a task gate or task state 
segment whose DPL is less privileged or the same 
privilege as the old task’s CPL. 


Any control transfer that changes CPL within a task 
causes a change of stacks as a result of the privilege 
level change. The initial values of SS:ESP for privilege 
levels 0, 1, and 2 are retained in the task state segment 
(see Section Task Switching). During a JMP or CALL 
control transfer, the new stack pointer is loaded in the 
SS and ESP registers and the previous stack pointer is 
pushed onto the new stack. 


When returning to the original privilege level, use of the 
lower-privilege stack is restored as part of the RET or 
IRET instruction operation. For subroutine calls that 
pass parameters on the stack and cross privilege levels, 
a fixed number of words (as specified in the gate’s word 
count field) are copied from the previous stack to the 
current stack. The intersegment RET instruction with a 
stack adjustment value will correctly restore the previ- 
ous stack pointer upon return. 


Cali Gates 


Gates provide protected, indirect CALLs. One of the 
major uses of gates is to provide a secure method of 
privilege transfers within a task. Since the operating 
system defines all the gates in a system, it can 
ensure that ail gates only allow entry into a few trusted 
procedures (such as those that allocate memory or per- 
form I/O). 
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Gate descriptors follow the data access rules of privi- 
lege; that is, gates can be accessed by a task if the EPL 
is equal to or more privileged than the gate descriptor’s 
DPL. Gates follow the control transfer rules of privilege 
and therefore may only transfer control to a more privi- 
leged level. 


Call gates are accessed via a CALL instruction and are 
syntactically identical to calling a normal subroutine. 
When an interlevel AmM386DX/DXL microprocessor call 
gate is activated, the following actions occur: 


1. Load CS:EIP from gate check for validity; 
2. SS is pushed zero-extended to 32 bits; 

3. ESP is pushed; 
4 


. Copy word count 32-bit parameters from the old 
stack to the new stack; 


5. Push return address on stack. 


The procedure is identical for 80286 Call gates, except 
that 16-bit parameters are copied and 16-bit registers 
are pushed. 


Interrupt gates and Trap gates work in a similar fashion 
as the call gates, except there is no copying of parame- 
ters. The only difference between Trap and Interrupt 
gates is that control transfers through an Interrupt gate, 
disable further interrupts (i.e., the IF bit is set to 0), and 
Trap gates leave the interrupt status unchanged. 


Task Switching 


Avery important attribute of any multitasking/multi-user 
operating system is its ability to rapidly switch between 
tasks or processes. The Am386DX/DXL microproces- 
sor directly supports this operation by providing a task 
switch instruction in hardware. The Am386DX/DXL 
CPU task switch operation saves the entire state of the 
machine (all of the registers, address space, and a link 
to the previous task), loads a new execution state, per- 
forms protection checks, and commences execution in 
the new task, in about 17 ms. Like transfer of control via 
gates, the task switch operation is invoked by executing 
an intersegment JMP or CALL instruction that refers to a 
Task State Segment (TSS), or a task gate descriptor in 
the GDT orLDT. An INT ninstruction, exception, trap, or 
external interrupt may also invoke the task switch opera- 
tion if there is a task gate descriptor in the associated 
IDT descriptor slot. 


The TSS descriptor points to a segment (see Figure 
29a) containing the entire AmM386DX/DXL microproces- 
sor execution state while a task gate descriptor contains 
a TSS selector. The Am386DX/DXL CPU supports both 
80286 and Am3886DX/DXL CPU style TSSs. Figure 30 
shows an 80286 TSS. The limit of an Am386DX/DXL 
microprocessor TSS must be greater than 0064H 
(O002BH for an 80286 TSS) and can be as large as 4 Gb. 
In the additional TSS space, the operating system is 
free to store additional information, such as the reason 
the task is inactive, time the task has spent running, and 
open files belonging to the task. 
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Each task must have a TSS associated with it. The cur- 
rent TSS is identified by a special register in the 
Am386DX/DXL microprocessor called the Task State 
Segment Register (TR). This register contains a selec- 
tor referring to the task state segment descriptor that de- 
fines the current TSS. A hidden base and limit register 
associated with TR are loaded whenever TR is loaded 
with a new selector. Returning from a task is accom- 
plished by the IRET instruction. When IRET is executed, 
control is returned to the task that was interrupted. The 
current executing task’s state is saved in the TSS and 
the old task state is restored from its TSS. 


Several bits in the flag register and machine status word 
(CRO) give information about the state of a task that are 
useful to the operating system. The Nested Task (NT) 
(bit 14 in EFLAGS) controls the function of the IRET in- 
struction. If NT = 0, the IRET instruction performs the 
regular return; when NT = 1, IRET performs a task 
switch operation back to the previous task. The NT bit is 
set or reset in the following fashion. 


When a CALL or INT instruction initiates a task switch, 
the new TSS will be marked busy and the back link 
field of the new TSS set to the old TSS selector. The NT 
bit of the new task is set by CALL or INT initiated task 
switches. An interrupt that does not cause a task switch 
will clear NT. (The NT bit willbe restored after execution 
of the interrupt handler.) NT may also be set or cleared 
by POPF or IRET instructions. 


The Am386DX/DXL microprocessor Task State Seg- 
ment is marked busy by changing the descriptor type 
field from Type 9H to Type BH. An 80286 TSS is 
marked busy by changing the descriptor type field from 
Type 1 to Type 3. Use of a selector that references a 
busy task state segment causes an Exception 13. 


The Virtual Mode (VM) bit 17 is used to indicate if a task 
is a virtual 8086 task. If VM=1, then the tasks will use 
the Real Mode addressing mechanism. The virtual 8086 
environment is only entered and exited via a task switch 
(see Section Virtual Mode). 


The coprocessor’s state is not automatically saved 
when a task switch occurs, because the incoming task 
may not use the coprocessor. The Task Switched (TS) 
Bit (bit 3 in the CRO) helps deal with the coprocessor’s 
state in a multitasking environment. Whenever the 
Am386DX/DXL microprocessor switches tasks, it sets 
the TS bit. The AM386DX/DXL CPU detects the first use 
of a processor extension instruction after a task switch 
and causes the processor extension not available Ex- 
ception 7. The exception handler for Exception 7 may 
then decide whether to save the state of the coproces- 
sor. A processor extension not present Exception 7 will 
occur when attempting to execute an ESC or WAIT in- 
struction if the Task Switched and Monitor coprocessor 


_ extension bits are both set (i.e., TS= 1 and MP=1). 
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Figure 30. 80286 TSS 


The T bit in the Am386DX/DXL microprocessor TSS in- 
dicates that the processor should generate a debug ex- 
ception when switching to a task. If T = 1, then upon en- 
try to a new task, a debug Exception 1 will be generated. 


initialization and Transition to Protected Mode 


Since the Am386DX/DXL microprocessor begins exe- 
cuting in Real Mode immediately after RESET, it is nec- 
essary to initialize the system tables and registers with 
the appropriate values. 


The GDT and IDT registers must refer to a valid GDT 
and IDT. The IDT should be at least 256-bytes long, 
and GDT must contain descriptors for the initial code 
and data segments. Figure 31 shows the tables and 
Figure 32 shows the descriptors needed for a simple 
Protected Mode Am386DX/DXL microprocessor sys- 
tem. It has a single code and single data/stack segment 
each 4 Gb long and a single privilege level PL=0. 


The actual method of enabling Protected Mode is to load 
CRO with PE bit set, via the MOV CRO, R/M instruction. 


This puts the Am386DX/DXL microprocessor in Pro- 
tected Mode. 


After enabling Protected Mode, the next instruction 
should execute an intersegment JMP to load the CS 
register and flush the instruction decode queue. The 
final step is to load all of the data segment registers with 
the initial selector values. 


An alternate approach to entering Protected Mode that 
is especially appropriate for multitasking operating sys- 
tems is to use the built in task-switch to load all of the 
registers. In this case, the GDT would contain two TSS 
descriptors in addition to the code and data descriptors 
needed for the first task. The first JMP instruction in Pro- 
tected Mode would jump to the TSS causing a task 
switch and loading all of the registers with the values 
storedinthe TSS. The TR should be initialized to point to 
a valid TSS descriptor since a task switch saves the 
state of the current task in a task state segment. 


Paging 
Paging Concepts 


Paging is another type of memory management useful 
for virtual memory multitasking operating systems. Un- 
like segmentation that modularizes programs and data 
into variable length segments, paging divides pro- 
grams into multiple uniform size pages. Pages bear no 
direct relation to the logical structure of a program. 
While segment selectors can be considered the logical 
name of a program module or data structure, a page 
most likely corresponds to only a portion of a module or 
data structure. 


By taking advantage of the locality of reference dis- 
played by most programs, only a small number of pages 
from each active task need be in memory at any one 
moment. 


Paging Organization 
Page Mechanism 


The Am386DX/DXL microprocessor uses two levels of 
tables to translate the linear address (from the segmen- 
tation unit) into a physical address. There are three com- 
ponents to the paging mechanism of the Am386DX/DXL 
CPU: the page directory, the page tables, and the page 
itself (page frame). All memory-resident elements of the 
Am386DX/DXL CPU paging mechanism are the same 
size, namely, 4 Kb. A uniform size for all of the elements 
simplifies memory allocation and reallocation schemes, 
since there is no problem with memory fragmentation. 
Figure 33 shows how the paging mechanism works. 
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Figure 32. GDT Descriptors for Simple System 


Page Descriptor Base Register 


CR2 is the Page Fault Linear Address register. It holds 
the 32-bit linear address that caused the last Page Fault 
detected. 


CR3 is the Page Directory Physical Base Address 
Register. It contains the physical starting address of the 
Page Directory. The lower 12 bits of CR3 are always 
zero to ensure that the Page Directory is always page 
aligned. Loading it via a MOV CR3, reg instruction 
causes the Page Table entry cache to be flushed, as will 


a task switch through a TSS that changes the value of 
CRO. (See Translation Look-Aside Buffer.) 


Page Directory 


The Page Directory is 4-Kb long and allows up to 1024 
Page Directory entries. Each Page Directory entry con- 
tains the address of the next level of tables, the Page Ta- 
bles and information about the page table. The contents 
of a Page Directory entry are shown in Figure 34. The 
upper 10 bits of the linear address (A31—A22) are used 
as an index to select the correct Page Directory entry. 
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Page Tables 


Each Page Table is 4 Kb and holds up to 1024 Page 
Table entries. Page Table entries contain the starting 
address of the page frame and statistical information 
about the page (see Figure 35). Address bits A21—-A12 
are used as an index to select one of the 1024 Page 
Table entries. The 20 upper-bit page frame address is 
concatenated with the lower 12 bits of the linear address 
to formthe physical address. Page tables canbe shared 
between tasks and swapped to disks. 


Page Directory/Table Entries 


The lower 12 bits of the Page Table entries and Page Di- 
rectory entries contain statistical information about 
pages and page tables respectively. The P (Present) bit 
0 indicates if a Page Directory or Page Table entry can 
be used in address translation. If P = 1, the entry can be 
used for address translation; if P = 0, the entry cannot be 
used for translation. Note that the present bit of the page 
table entry that points to the page where code is cur- 
rently being executed should always be set. Code that 
marks its own page not present should not be written. All 
of the other bits are available for use by the software. For 
example the remaining 31 bits could be used to indicate 
where on the disk the page is stored. 


The A (Accessed) bit 5 is set by the Am386DX/DXL mi- 
croprocessor for both types of entries before a read or 
write access occurs to an address covered by the entry. 
The D (Dirty) bit 6 is set to 1 before a write to an address 
covered by that page table entry occurs. The D bit is un- 
defined for Page Directory entries. When the P, A, and 
D bits are updated by the Am386DX/DXL CPU, the mi- 
croprocessor generates a Read-Modify-Write cycle that 
locks the bus and prevents conflicts with other proces- 
sors or peripherals. Software that modifies these bits 
should use the LOCK prefix to ensure the integrity of the 
page tables in multi-master systems. 


The three bits marked OS Reserved in Figures 34 and 
35 (bits 11-9) are software definable. OSs are free to 
use these bits for whatever purpose they wish. An 
example use of the OS Reserved bits would be to store 
information about page aging. By keeping track of how 
long a page has been in memory since being accessed, 
an operating system can implement a page replace- 
ment algorithm like Least Recently Used. 


The (User/Supervisor) U/S bit 2 and the (Read/Write) 
R/W bit 1 are used to provide protection attributes for 
individual pages. 


Page Level Protection (R/W, U/S Bits) 


The Am886DX/DXL microprocessor provides a set of 
protection attributes for paging systems. The paging 
mechanism distinguishes between two levels of pro- 
tection: user, which corresponds to level 3 of the 
segmentation based protection, and supervisor, which 
encompasses all of the other protection levels (0, 7, 2). 
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Programs executing at level 0, 1, or 2 bypass the page 
protection, although segmentation based protection is 
still enforced by the hardware. 


The U/S and R/W bits are used to provide User/Supervi- 
sor and Read/Write protection for individual pages or for 
all pages covered by a Page Table Directory entry. The 
U/S and R/W bits in the first level Page Directory Table 
apply to all pages described by the page table pointed to 
by that directory entry. The U/S and R/W bits in the sec- 
ond level Page Table entry apply only to the page de- 
scribed by that entry. The U/S and R/W bits for a given 
page are obtained by taking the most restrictive of the 
U/S and R/W bits from the Page Directory Table entries 
and the Page Table entries and using these bits to ad- 
dress the page. 


Example: If the U/S and R/W bits for the Page Directory 
entry were 10 and the U/S and R/W bits for the Page Ta- 
ble entry were 01, the access rights for the page would 
be 01, the numerically smaller of the two. Table 12 
shows the effect of the U/S and R/W bits on accessing 
memory. 


Table 12. Protection Provided by R/W and U/S 


| Permitted Permitted Access 
U/S Level 3 Levels 0, 1, or 2 

| oO Read/Write 

Read/Write 


Read/Write 
Read/Write 







None 








None 


Read-Only 
Read/Write 










However, a given segment can be easily made read- 
only for level 0, 1, or 2 via the use of segmented protec- 
tion mechanisms (see Section Protection). 


Translation Look-Aside Buffer 


The Am386DX/DXL microprocessor paging hardware 
is designed to support demand paged virtual memory 
systems. However, performance would degrade sub- 
stantially if the processor was required to access two 
levels of tables for every memory reference. To solve 
this problem, the Am386DX/DXL device keeps a cache 
of the most recently accessed pages, this cache is 
called the Translation Look-Aside Buffer (TLB). The 
TLB is a four-way set associative 32-entry page table 
cache. It automatically keeps the most commonly used 
Page Table entries in the processor. The 32-entry TLB, 
coupled with a 4K page size, results in coverage of 
128 Kb of memory addresses. For many common multi- 
tasking systems, the TLB will have a hit rate of about 
98%. This means that the processor will only have to 
access the two-level page structure on 2% of all memory 
references. Figure 36 illustrates how the TLB com- 
plements the Am386DX/DXL microprocessor’s paging 
mechanism. 
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Figure 36. Translation Look-Aside Buffer 


Paging Operation 


The paging hardware operates in the following fashion: 
the paging unit hardware receives a 32-bit linear ad- 
dress from the segmentation unit. The upper 20 linear 
address bits are compared with all 32 entries in the TLB 
to determine if there is a match. If there is a match (i.e., a 
TLB hit), then the 32-bit physical address is calculated 
and will be placed on the address bus. 


However, if the Page Table entry is not in the TLB, the 
Am386DX/DXL microprocessor will read the appro- 
priate Page Directory entry. If P = 1 on the Page Direc- 
tory entry indicating that the page table is in memory, 
then the Am386DX/DXL device will read the appro- 
priate Page Table entry and set the Access bit. If P = 1 
on the Page Table entry indicating that the page is in 
memory, the Am386DX/DXL device will update the 
Access and Dirty bits as needed and fetch the operand. 
The upper 20 bits of the linear address, read from the 
page table, willbe stored in the TLB for future accesses. 
However, if P = 0 for either the Page Directory entry or 
the Page Table Entry, then the processor will generate 
a Page Fault, an Exception 14. 


The processor will also generate an Exception 14, Page 
Fault, if the memory reference violated the page protec- 
tion attributes (i.e., U/S or R/W; trying to write to a read- 
only page). CR2 will hold the linear address that caused 
the page fault. lf a second page fault occurs while the 
processor is attempting to enter the service routine for 
the first, then the processor will invoke the Page Fault 
(Exception 14) handler a second time, rather than the 
Double Fault (Exception 8) handler. Since Exception 14 


is classified as a fault, CS:EIP will point to the instruction 
causing the page fault. The 16-bit error code pushed as 
part of the page fault handler will contain status bits 
which indicate the cause of the Page Fault. 


The 16-bit error code is used by the operating system to 
determine how to handle the Page Fault. Figure 37 
shows the format of the page-fault error code and the in- 
terpretation of the bits. 


Note: Even though the bits in the error code (U/S, R/W, 
and P) have similar names as the bits in the Page Direc- 
tory/Table entries, the interpretation of the error code 
bits is different. Figure 38 indicates what type of access 
caused the Page Fault. 


15 3.2 1 0 
| ! | | | ulwl | 
U,U;UPUL UP UP UPUT UYU; UPUTU 

S|R 
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Figure 37. Page Fault Error Code Format 


U/S: The U/S bit indicates whether the access causing 
the fault occurred when the processor was executing 
the User Mode (U/S=1) or in Supervisor mode 
(U/S = 0). 


R/W: The R/W bit indicates whether the access causing 
the fault was a Read (R/W = 0) or a Write (R/W = 1). 


P: The P bit indicates whether a Page Fault was caused 
by a not-present page (P = 0) or by a page level protec- 
tion violation (P = 1). 


U: Undefined. 


Supervisor* Read 
Supervisor Write 
User Read 

User Write 






“Descriptor table access will fault with U/S =0, even if the 
program is executing at level 3. 


15021B-041 
Figure 38. Type of Access Causing Page Fault 


Operating System Responsibilities 


The Am386DX/DXL microprocessor takes care of the 
page address translation process, relieving the burden 
from an operating system in a demand-paged system. 
The operating system is responsible for setting up the 
initial page tables and handling any page faults. The op- 
erating system is also required to invalidate (i.e., flush) 
the TLB when any changes are made to any of the Page 
Table entries. The operating system must reload CR3 to 
cause the TLB to be flushed. 
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Setting up the tables is simply a matter of loading CR3 
with the address of the Page Directory and allocating 
space for the Page Directory and the Page Tables. The 
primary responsibility of the operating system is to im- 
plement a swapping policy and handle all of the page 
faults. 


A final concern of the operating system is to ensure that 
the TLB cache matches the information in the paging ta- 
bles. In particular, any time the operating system sets 
the P present bit of page table entry to zero, the TLB 
must be flushed. Operating systems may want to take 
advantage of the fact that CR3 is stored as partofa TSS 
to give every task or group of tasks its own set of page 
tables. 


Virtual 8086 Environment 
Executing 8086 Programs 


The Am386DX/DXL microprocessor allows the execu- 
tion of 8086 application programs in both Real Mode 
and in the Virtual 8086 Mode (Virtual Mode). Of the two 
methods, Virtual 8086 Mode offers the system designer 
the most flexibility. The Virtual 8086 Mode allows the 
execution of 8086 applications, while still allowing 
the system designer to take full advantage of the 
Am386DX/DXL device protection mechanism. In par- 
ticular, the Am386DX/DXL CPU allows the simultane- 
ous execution of 8086 operating systems and its appli- 
cations, and an Am386DX/DXL CPU operating system 
and both 80286 and Am386DX/DXL microprocessor 
applications. Thus, in a multiuser Am386DX/DXL CPU 
computer, one person could be running a MS-DOS 
spreadsheet, another person using MS-DOS, and a 
third person could be running multiple UNIX utilities and 
applications. Each person inthis scenario would believe 
they had the computer completely to themself. Figure 39 
illustrates this concept. 


Virtual 8086 Mode Addressing Mechanism 


One of the major differences between Am386DX/DXL 
microprocessor Real and Protected Modes is how the 
segment selectors are interpreted. When the processor 
is executing in Virtual 8086 Mode, the segment registers 
are used in an identical fashion to Real Mode. The 
contents of the segment register are shifted left 4 bits 
and added to the offset to form the segment base linear 
address. 


The Am386DX/DXL microprocessor allows the operat- 
ing system to specify which programs use the 8086 style 
address mechanism, and which programs use Pro- 
tected Mode addressing, on a per task basis. Through 
the use of paging, the 1-Mb address space of the Virtual 
Mode task can be mapped to anywhere in the 4-Gb lin- 
ear address space of the Am386DX/DXL device. Like 
Real Mode, Virtual Mode effective addresses (i.e., seg- 
ment offsets) that exceed 64 Kb will cause an Exception 
13. However, these restrictions should not prove to be 
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important because most tasks running in Virtual 8086 
Mode will simply be existing 8086 application programs. 


Paging In Virtual Mode 


The paging hardware allows the concurrent running 
of multiple Virtual Mode tasks and provides protection 
and operating system isolation. Although it is not 
Strictly necessary to have the paging hardware enabled 
to run Virtual Mode tasks, it is needed in order to run 
multiple Virtual Mode tasks or to relocate the address 
space of a Virtual Mode task to physical address space 
greater than 1 Mb. 


The paging hardware allows the 20-bit linear address 
produced by a Virtual Mode program to be divided into 
up to 256 pages. Each one of the pages can be located 
anywhere within the maximum 4-Gb physical address 
space of the Am386DX/DXL microprocessor. In addi- 
tion, since CR3 (the Page Directory Base Register) is 
loaded by a task switch, each Virtual Mode task can use 
a different mapping scheme to map pages to different 
physical locations. Finally, the paging hardware allows 
the sharing of the 8086 operating system code between 
multiple 8086 applications. Figure 39 shows how the 
Am386DX/DXL device paging hardware enables multi- 
ple 8086 programs to run under a virtual memory de- 
mand paged system. 


Protection and I/O Permission Bitmap 


All Virtual 8086 Mode programs execute at privilege 
level 3, the level of least privilege. As such, Virtual 8086 
Mode programs are subject to all of the protection 
checks defined in Protected Mode. (This is different 
from Real Mode which implicitly is executing at privilege 
level 0, the level of greatest privilege.) Thus, an attempt 
to execute a privileged instruction when in Virtual 8086 
Mode will cause an Exception 13 fault. 


The following are privileged instructions, which may be 
executed only at Privilege Level 0. Therefore, attempt- 
ing to execute these instructions in Virtual 8086 Mode 
(or anytime CPL > 0) causes an Exception 13 fault. 


LIDT; MOV DRn, reg; MOV reg,DRn; 
LGDT; MOV TRn,reg; MOV reg, TRn; 
LMSW; MOV CRn, reg; MOV reg, CRn; 
CLTS; 

HLT; 


Several instructions, particularly those applying to the 
multitasking model and protection model, are available 
only in Protected Mode. Therefore, attempting to exe- 
cute the following instructions in Real Mode or in Virtual 
8086 Mode generates an Exception 6 fault. 


LTR; Sik; 

LLDT; SLDT; 
LAR; VERR; 
LS; VERW; 


ARPL. 
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Figure 39. Virtual 8086 Environment Memory Management 


The instructions that are |OPL-sensitive in Protected 
Mode are: 

IN; STI; 

OUT; CLI; 

INS; 

OUTS; 

REP INS; 

REP OUTS. 


In Virtual 8086 Mode, a slightly different set of instruc- 
tions are made IOPL-sensitive. The following instruc- 
tions are |OPL-sensitive in Virtual 8086 Mode: 


INT n; STI; 
PUSHF; CLI 
POPF; IRET. 


The PUSHF, POPF, and IRET instructions are |OPL- 
sensitive in Virtual 8086 Mode only. This provision al- 
lows the IF flag (interrupt enable flag) to be virtualized to 
the Virtual 8086 Mode program. The INT n software 


interrupt instruction is also [OPL-sensitive in Virtual 
8086 Mode. Note, however, that the INT 3 (op-code 
OCCH), INTO, and BOUND instructions are not [OPL- 
sensitive in Virtual 8086 Mode (they are not IOPL sensi- 
tive in Protected Mode either). 


Note that the I/O instructions (IN, OUT, INS, OUTS, 
REP INS, and REP OUTS) are not!OPL-sensitive in Vir- 
tual 8086 Mode. Rather, the I/O instructions become 
automatically sensitive to the I/O Permission Bitmap 


‘contained inthe Am3886DX/DXL CPU TSS. The I/O Per- 


mission Bitmap, automatically used by the Am386DX/ 
DXL microprocessor in Virtual 8086 Mode, is illustrated 
by Figures 29a and 29b. 


The I/O Permission Bitmap can be viewed as a 
0-64K bit string, that begins in memory at offset 
Bit_Map_ Offset in the current TSS. Bit_Map_ Offset 
must be < DFFFH so the entire bit map and the byte FFH 
that follows the bit map are all at offset < FFFFH fromthe 
TSS base. The 16-bit pointer Bit_Map_ Offset (15-0) is 
found in the word beginning at offset 66H (102 decimal) 
from the TSS base, as shown in Figure 29a. 
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Each bit in the I/O Permission Bitmap corresponds to a 
single byte-side I/O port, as illustrated in Figure 29a. Ifa 
bit is 0, I/O to the corresponding byte-wide port can oc- 
cur without generating an exception. Otherwise the I/O 
instruction causes an Exception 13 fault. Since every 
byte-wide I/O port must be protectable, all bits corre- 
sponding to a Word-wide or Dword-wide port must be 0 
for the Word-wide or Dword-wide I/O to be permitted. If 
all the referenced bits are 0, the 1/O will be allowed. If 
any referenced bits are 1, the attempted 1/O will cause 
an Exception 13 fault. 


Due to the use of a pointer to the base of the I/O Permis- 
sion Bitmap, the bitmap may be located anywhere within 
the TSS or may be ignored completely by pointing the 
Bit_Map_ Offset (15-0) beyond the limit of the TSS 
segment. In the same manner, only a small portion of 
the 64K I/O space need have an associated map bit by 
adjusting the TSS limit to truncate the bitmap. This 
eliminates the commitment of 8K of memory when a 
complete bitmap is not required, while allowing the fully 
general case if desired. 


Example of Bitmap for I/O Ports 0-255: Setting the TSS 
limit to {Bit_Map_ Offset + 31 +1**} [**see note below] 
will allow a 32-byte bitmap for the I/O ports 0-255, plus a 
terminator byte of all 1s [““see note below]. This allows 
the I/O bitmap to control I/O Permission to I/O ports 
0-255 while causing an Exception 13 fault on attempted 
I/O to any I/O port 256 through 65,565. 


**Important Implementation Note: Beyond the last byte of 
/O mapping, information in the I/O Permission Bitmap must 
be a byte containing all 1s. The byte of all 1s must be within the 
limit of the Am386DX/DXL CPU TSS segment (see Figure 
29a). 


interrupt Handling 


In order to fully support the emulation of an 8086 ma- 
chine, interrupts in Virtual 8086 Mode are handled ina 
unique fashion. When running in Virtual Mode, all inter- 
rupts and exceptions involve a privilege change back 
to the host AmM386DX/DXL CPU operating system. The 
Am386DX/DXL microprocessor operating system de- 
termines if the interrupt comes from a Protected Mode 
application or from a Virtual Mode program by examin- 
ing the VM bit inthe EFLAGS image stored onthe stack. 


When a Virtual Mode program is interrupted and execu- 
tion passes to the interrupt routine at level 0, the VM bit 
is cleared. However, the VM bitis still set inthe EFLAGS 
image on the stack. 


The Am386DX/DXL microprocessor operating system 
in turn handles the exception or interrupt and then re- 
turns control to the 8086 program. The Am386DX/DXL 
CPU operating system may choose to let the 8086 oper- 
ating system handle the interrupt or it may emulate the 
function of the interrupt handler. For example, many 
8086 operating system calls are accessed by PUSHing 
parameters on the stack, and then executing an INT n 
instruction. If the IOPL is set to 0 then all INT n in- 
structions will be intercepted by the Am386DX/DXL 
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microprocessor operating system. The Am386DX/DXL 
CPU operating system could emulate the 8086 operat- 
ing system's call. Figure 40 shows how the Am386DX/ 
DXL microprocessor operating system could intercept 
an 8086 operating system's call to Open a File. 


The Am386DX/DXL microprocessor operating system 
can provide a Virtual 8086 Environment that is totally 
transparent to the application software via intercepting 
and then emulating 8086 operating system’s calls, and 
intercepting IN and OUT instructions. 


Entering and Leaving Virtual 8086 Mode 


Virtual 8086 Mode is entered by executing an IRET in- 
struction (at CPL = 0), or Task Switch (at any CPL) to an 
Am386DX/DXL microprocessor task whose Am386DX/ 
DXL microprocessor TSS has an EFLAGS image con- 
taining a 1 in the VM bit position while the processor is 
executing in Protected Mode. That is, one way to enter 
Virtual 8086 Mode is to switch to a task with an 
Am386DX/DXL device TSS that has a 1 in the VM bit in 
the EFLAGS image. The other way is to execute a 32-bit 
IRET instruction at privilege level 0, where the stack has 
a1 inthe VM bit inthe EFLAGS image. POPF does not 
affect the VM bit even if the processor is in Protected 
Mode or level 0, and so cannot be used to enter Virtual 
8086 Mode. PUSHF always pushes a 0 in the VM bit, 
even if the processor is in Virtual 8086 Mode, so that a 
program cannot tell if it is executing in Real Mode or in 
Virtual 8086 Mode. 


The VM bit can be set by executing an IRET instruction 
only at privilege level 0 or by any instruction or interrupt 
that causes a task switch in Protected Mode (with VM = 
1 in the new FLAGS image), and can be cleared only by 
an interrupt or exception in Virtual 8086 Mode. IRET and 
POPF instructions executed in Real Mode or Virtual 
8086 Mode will not change the value in the VM bit. 


The transition out of Virtual 8086 Mode to Am386DX/ 
DXL microprocessor Protected Mode occurs only on re- 
ceipt of an interrupt or exception (such as due to a sensi- 
tive instruction). In Virtual 8086 Mode, all interrupts and 
exceptions vector through the Protected Mode IDT, 
and enter an interrupt handler in Am386DX/DXL CPU 
Protected Mode. That is, as part of interrupt processing, 
the VM bit is cleared. 


Because the matching IRET must occur from level 0, if 
an Interrupt or Trap gate is used to field an interrupt or 
exception out of Virtual 8086 Mode, the gate must per- 
form an interlevel interrupt only to level 0. Interrupt or 
Trap gates through conforming segments or through 
segments with DPL > 0, will raise a GP fault with the CS 
selector as the error code. 


Task Switches To/From Virtual 8086 Mode 


Tasks which can execute in Virtual 8086 Mode must be 
described by a TSS with the new Am386DX/DXL micro- 
processor format (Type 9 or 11 descriptor). 
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Figure 40. Virtual 8086 Environment Interrupt and Call Handling 


A task switch out of Virtual 8086 Mode will operate 
exactly the same as any other task switch out of a task 
with an Am386DX/DXL CPU TSS. All of the program- 
mer visible state, including the FLAGS register with the 
VM bit setto 1, is stored inthe TSS. The segment regis- 
ters in the TSS will contain 8086 segment base values 
rather than selectors. 


Atask switch into a task described by an Am386DX/DXL 
microprocessor TSS will have an additional check to 
determine if the incoming task should be resumed in 
Virtual 8086 Mode. Tasks described by 80286 format 
TSSs cannot be resumed in Virtual 8086 Mode, so no 
check is required there (the FLAGS image in 80286 
format TSS has only the low-order 16 FLAGS bits). Be- 
fore loading the segment register images from an 
Am386DX/DXL CPU TSS, the FLAGS image is loaded 
so that the segment registers are loaded from the TSS 
image as 8086 segment base values. The task is now 
ready to resume in Virtual 8086 Execution Mode. 


Transitions Through Trap and Interrupt Gates, 
and IRET 


A task switch is one way to enter or exit Virtual 8086 
Mode. The other method is to exist through a Trap or In- 
terrupt gate, as part of handling an interrupt, and to enter 
as part of executing an IRET instruction. The transition 
out must use an Am3886DX/DXL microprocessor Trap 
gate (Type 14) or Interrupt gate (Type 15) that must 
point to a non-conforming level 0 segment (DPL = 0) in 
order to permit the trap handler to IRET back to the 
Virtual 8086 program. The gate must point to a non- 
conforming level 0 segment to perform a level switch to 
level 0 so that the matching IRET can change the VM 
bit. Am386DX/DXL device gates must be used, since 
80286 gates save only the lower 16 bits of the FLAGS 
register, so that the VM bit will not be saved on transi- 
tions through the 80286 gates. Also, the 16-bit IRET 
(presumably) used to terminate the 80286 interrupt han- 
dler will pop only the lower 16 bits from FLAGS, and will 
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not affect the VM bit. The action taken for an Am386DX/ 
DXL microprocessor Trap or Interrupt gate if an interrupt 
occurs while the task is executing in Virtual 8086 Mode 
is given by the following sequence. 


1. Save the FLAGS register in a temp to push later. 
Turn off the VM and TF bits, and if the interrupt is 
serviced by an Interrupt gate, turn off IF bit, also. 


2. Interrupt and Trap gates must perform a level switch 
from3 (where the VM86 program executes) to level 0 
(so IRET can return). This process involves a stack 
switch to the stack given in the TSS for privilege 
level 0. Save the Virtual 8086 Mode SS and ESP 
registers to push in a later step. The segment 
register load of SS will be done as a Protected Mode 
segment load since the VM bit was turned off above. 


3. Pushthe 8086 segment register vaiues onto the new 
stack, in the order: GS, FS, DS, ES. These are 
pushed as 32-bit quantities with undefined values in 
the upper 16 bits. Then load these 4 registers with 
null selectors (0). 


4. Push the old 8086 stack pointer onto the new stack 
by pushing the SS register (as 32-bit, high bits 
undefined), then pushing the 32-bit ESP register 
saved above. 


5. Push the 32-bit FLAGS register saved in step 1. 


6. Push the old 8086 instruction pointer onto the new 
stack by pushing the CS register (as 32-bits, high bits 
undefined), then pushing the 32-bit EIP register. 


7. Load up the new CS:EIP value from the interrupt 
gate and begin execution of the interrupt routine in 
Protected Am386DX/DXL Microprocessor Mode. 


The transition out of Virtual 8086 Mode performs a level 
change and stack switch, in addition to changing back to 
Protected Mode. In addition, all of the 8086 segment 
register images are stored on the stack (behind the 
SS:ESP image), and then loaded with null (0) selectors 
before entering the interrupt handler. This will permit the 
handler to safely save and restore the DS, ES, FS, and 
GS registers as 80286 selectors. This is needed so that 
interrupt handlers that “don’t care” about the mode of the 
interrupted program can use the same prolog and epilog 
code for state saving (i.e., push all registers in prolog, 
pop all in epilog) regardless of whether or not a native 
mode or Virtual 8086 Mode program was interrupted. 
Restoring null selectors to these registers before exe- 
cuting the IRET will not cause a trap in the interrupt han- 
dler. Interrupt routines that expect values in the segment 
registers or return values in segment registers will have 
to obtain/return values from the 8086 register images 
pushed onto the new stack. They will need to know the 
mode of the interrupted program in order to know 
where to find/return segment registers, and also to 
know how to interpret segment register values. 
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The IRET instruction will perform the inverse of the 
above sequence. Only the extended Am386DX/DXL 
microprocessor IRET instruction (operand size = 32) 
can be used and must be executed at level 0 to change 
the VM bit to 7. 


1. Ifthe NT bit inthe FLAGS register is on, an inter-task 
return is performed. The current state is stored in the 
current TSS, and the link field in the current TSS is 
used to locate the TSS for the interrupted task which 
is to be resumed. 


Otherwise, continue with the following sequence. 


2. Read the FLAGS image from SS:8[ESP] into the 
FLAGS register. This will set VM to the value active 
in the interrupted routine. 


3. Pop off the instruction pointer CS:EIP. EIP is popped 
first, then a 32-bit word is popped that contains the 
CS value in the lower 16 bits. If VM = 0, this CS 
load is done as a Protected Mode segment load. If 
VM = 1, this will be done as an 8086 segment load. 


4. Increment the ESP register by 4 to bypass the 
FLAGS image which was popped in step 1. 


5. If VM=1, load segment registers ES, DS, FS, 
and GS from memory locations SS:[ESP +8], 
SS[ESP +12], SS[ESP +16], and SS:[ESP +20], 
respectively, where the new value of ESP stored in 
step 4 is used. Since VM = 1, these are done as 8086 
segment register loads. 


Else if VM = 0, check that the selectors in ES, DS, 
FS, and GS are valid in the interrupted routine. Null 
out invalid selectors to trap if an attempt is made to 
access through them. 


6. If (RPL(CS) > CPL), pop the stack pointer SS:ESP 
from the stack. The ESP register is popped first, 
followed by 32-bits containing SS in the lower 16 bits. 
If VM =0, SS is loaded as a Protected Mode segment 
register load. If VM = 1, an 8086 segment register 
load is used. 


7. Resume execution of the interrupted routine. The 
VM bit in the FLAGS register (restored from the 
interrupt routine’s stack image in step 1) determines 
whether the processor resumes the _ interrupted 
routine in Protected Mode of Virtual 8086 Mode. 
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FUNCTIONAL DATA 
Introduction 


The Am3886DX/DXL microprocessor features a straight 
forward functional interface to the external hardware. 
The Am386DX/DXL CPU has separate parallel buses 
for data and address. The data bus is 32 bits in width and 
is bidirectional. The address bus outputs 32-bit address 
values in the most directly usable form for the high- 
speed local bus: 4 individual Byte Enable signals and 
the 30 upper-order bits as a binary value. The data and 
address buses are interpreted and controlled with their 
associated control signals. 


A dynamic data bus sizing feature allows the processor 
to handle a mix of 32- and 16-bit external buses on a 
cycle-by-cycle basis (see Data Bus Sizing). If 16-bit bus 
size is selected, the Am386DX/DXL microprocessor 
automatically makes any adjustment needed, even 
performing another 16-bit bus cycle to complete the 
transfer if that is necessary. Any 8-bit peripheral devices 
may be connected to 32- or 16-bit buses with no loss of 
performance. A new address pipelining option is pro- 
vided and applies to 32- and 16-bit buses for substan- 
tially improved memory utilization, especially for the 
most heavily used memory resources. 


The address pipelining option, when selected, typically 
allows a given memory interface to operate with one 
less wait state than would otherwise be required (see 
Address Pipelining). The pipelined bus is also well 
suited to interleaved memory designs. When address 
pipelining is requested by the external hardware, the 
Am386DX/DXL microprocessor will output the address 
and bus cycle definition of the next bus cycle (if it is inter- 
nally available) even while waiting for the current cycle 
to be acknowledged. 


Non-pipelined address timing, however, is ideal for 
external cache designs, since the cache memory will 
typically be fast enough to allow non-pipelined cycles. 
_ For maximum design flexibility, the address pipelining 
option is selectable on a cycle-by-cycle basis. 


The processor's bus cycle is the basic mechanism for 
information transfer, either from system to processor or 
from processor to system. Am386DX/DXL microproces- 
sor bus cycles perform data transfer in a minimum of 
only two clock periods. On a 32-bit data bus, the 
maximum Am3886DX/DXL device transfer at 20-MHz 
bandwidth is therefore 40 Mb/s, at 25-MHz bandwicth is 
50 Mb/s, at 33-MHz bandwidth is 66 Mb/s, and at 
40-MHz bandwidth is 80 Mb/s. Any bus cycle will be 
extended for more than two clock periods, however, if 
external hardware withholds acknowledgment of the 
cycle. At the appropriate time, acknowledgment is 
signaled by asserting the Am386DX/DXL microproces- 
sor READY input. 


The Am386DX/DXL CPU can relinquish control of its 
local buses to allow mastership by other devices, such 


as direct memory access channels. When relinquished, 
HLDA is the only output pin driven by the Am386DX/ 
DXL microprocessor providing near-complete isolation 
of the processor from its system. The near-complete 
isolation characteristic is ideal when driving the system 
from test equipment and in fault-tolerant applications. 


Functional data covered in this section describes the 
processor's hardware interface. First, the set of signals 
available at the processor pins is described (see Signal 
Description). Following that are the signal waveforms 
occurring during bus cycles (see Bus Transfer Mecha- 
nism, Bus Functional Description, and Other Functional 
Descriptions). 


Signal Description 
Introduction 


Ahead is a brief description of the Am3886DX/DXL CPU 
input and output signals arranged by functional groups 
(see Figure 41). 


Example signal: 


M/IO —High voltage indicates Memory selected 
—Low voltage indicates I/O selected 


The signal descriptions sometimes refer to AC timing 
parameters, such as t25 RESET Setup Time and t26 
RESET Hold Time. 


Clock (CLK2) 


CLK2 provides the fundamentai timing for the 
Am386DX/DXL microprocessor. It is divided by two in- 
ternally to generate the internal processor clock used for 
instruction execution. The internal clock is comprised of 
two phases, phase one and phase two. Each CLK2 pe- 
riod is a phase of the internal clock. Figure 42 illustrates 
the relationship. If desired, the phase of the internal 
processor clock can be synchronized to a known phase 
by ensuring the RESET signal falling edge meets its ap- 
plicable setup and hold times, t25 and t26. 


Data Bus (D31-D0) 


These three-state, bidirectional signals provide the gen- 
eral purpose data path between the Am386DX/DXL mi- 
croprocessor and other devices. Data bus inputs and 
outputs indicate 1 when High. The data bus can transfer 
data on 32- and 16-bit buses using a data bus sizing 
feature controlled by the BS16 input. See Section Bus 
Control. Data bus reads require that read data setup and 
hold times, t21 and t22, be met for correct operation. In 
addition, the Am386DX/DXL microprocessor requires 
that all data bus pins be at a valid logic state (High or 
Low) at the end of each read cycle, when READY is 
asserted. During any write operation (and during halt 
cycles and shut down cycles), the Am386DX/DXL 
microprocessor always drives all 32 signals of the data 
bus even if the current bus size is 16 bits. 
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Figure 41. Functional Signal Groups 
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Figure 42. CLK2 Signal and Internal Processor Clock 
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Address Bus (BE3—BE0, A31-A2) 


These three-state outputs provide physical memory 
addresses or I/O port addresses. The address bus is 
capable of addressing 4 Gb of physical memory space 
(OOOOOO0OOH-FFFFFFFFH), and 64 kb of I/O address 
space (00000000H—O000FFFFH) for programmed I/O. 
/O transfers automatically generated for Am386DX/ 
DXL microprocessor-to-coprocessor communication 
use I/O addresses 800000F8H-800000FFH, so A31 is 
High in conjunction with M/IO Low allows simple gen- 
eration of the coprocessor select signal. 


The Byte Enable outputs, BE3-BEO, directly indicate 
which bytes of the 32-bit data bus are involved with the 
current transfer. This is most convenient for external 
hardware. 


EO applies to D7—D0 
E1 applies to D15—D8 
E2 applies to D23—D16 
BE3 applies to D31—D24 


alg 


W 


The number of Byte Enables asserted indicates the 
physical size of the operand being transferred (1, 2, 3, or 
4 bytes). Refer to Section Operand Alignment. 


When a memory write cycle or I/O write cycle is in pro- 
gress and the operand being transferred occupies only 
the upper 16 bits of the data bus (D31—D16), duplicate 
data is simultaneously presented on the corresponding 
lower 16 bits of the data bus (D15—D0). This duplication 


is performed for optimum write performance on 16 bit 
buses. The pattern of write data duplication is a function 
of the Byte Enables asserted during the write cycle. 
Table 13 lists the write data present on D31—D0O, as a 
function of the asserted Byte Enable outputs BE3—BEO. 


Bus Cycle Definition Signals (W/R, D/C, M/1O, 
LOCK) 





These three-state outputs define the type of bus cycle 
being performed. W/R distinguishes between write 
and read cycles, D/C between data and control cycles, 
M/IO between memory and I/O cycles, and LOCK 
between locked and unlocked bus cycles. 





The primary bus cycle definition signals are W/R, D/C, 
and M/IO, since these are the signals driven valid as the 
ADS (Address Status output) is driven asserted. The 
LOCK is driven valid at the same time as the first locked 
bus cycle begins, which due to address pipelining, could 
be later than ADS is driven asserted. See Pipelined Ad- 
dress. The LOCK is negated when the READY input 
terminates the last bus cycle that was locked. 








Exact bus cycle definitions, as a function of W/R, D/C, 
and M/IO, are given in Table14. Note one combination 
of W/R, D/C, and M/IO is never given when ADS is as- 
serted (however, that combination, which is listed as 
does not occur, may occur during idle bus states when 
ADS is not asserted). If M/1O, D/C, and W/R are quali- 
fied by ADS asserted, then a decoding scheme may be 
simplified by using this definition. 


Table 13. Write Data Duplication as a Function of BE3—BEO 


Am386DX/DXL CPU Byte Enables Am386DX/DXL CPU Write Data automatic, | 


| BES BE? BET BED |_1-D24 





Key: D=Logical Write Data D31—-D24 
C =Logical Write Data D23—-D16 


D23-D16_ —_—iD15--D8 


Undef 
Undef 
C 
Undef 


D7-DO | Duplication? | 


Undef 
C 
C 


Cc 
C 


B =Logical Write Data D15—D8 
A=Logical Write Data D7—-DO 
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Table 14. Bus Cycle Definition 


| tow | interrupt Acknowiedge |] Yes 
High [DoesNotOccur | 

[tow [vO DataRead 

Low 

[High [tow [tow [Memory Code Read 


High Low High Halt: 
: | | | Address = 2 
| | BEO High 
BE1 High 
| BE2 Low 
BES High 
A31—A2 Low 









Yes 








Bus Control Signals (ADS, READY, NA, BS16) 
Introduction 


The following signals allow the processor to indicate 
when bus cycle has begun and allow other system hard- 
ware to control address pipelining, data bus width, and 
bus cycle termination. 


Address Status (ADS) 


This three-state output indicates that a valid bus cycle 
definition and address (W/R, D/C, M/IO, BE3-BEO, and 
A31-—A2) is being driven at the Am386DX/DXL micro- 
processor pins. It is asserted during T1 and T2P bus 
states (see Non-pipelined Address and Pipelined 


Address for additional information on bus states). 
Transfer Acknowledge (READY) 





This input indicates the current bus cycle is complete, 
and the active bytes indicated by BE3—-BE0 and BS16 
are accepted or provided. When READY is sampled 
asserted during a read cycle or interrupt acknowledge 
cycle, the Am386DX/DXL microprocessor latches the 
input data and terminates the cycle. When READY is 
sampled asserted during a write cycle, the processor 
terminates the bus cycle. 





READY is ignored on the first bus state of all bus cycles, 
and sampled each bus state thereafter until asserted. 
READY must eventually be asserted to acknowledge 
every bus cycle, including Halt Indication and Shutdown 
Indication bus cycles. When being sampled, READY 
must always meet setup and hold times, t19 and t20, for 
correct operation. See all sections of Bus Functional 
Description. 


Next Address Request (NA) 


This is used to request address pipelining. This input 
indicates the system is prepared to accept new values 
of BE3-BEO, A31-A2, W/R, D/C, and M/IO from 
the Am386DX/DXL microprocessor even if the end of 


Pe 
Shutdown: 
Address =0 
BEO Low 
BE7 High 
BE2 High 
BE3 High 
A31—A2 Low 


Some Cycles 





the current cycle is not being acknowledged on READY. 
If this input is asserted when sampled, the next address 
is driven onto the bus provided the next bus request is 
already pending internally. See Address Pipelining and 
Read and Write Cycles. NA must always meet setup 
and hold times, t15 and t16, for correct operation. 


Bus Size 16 (BS16) 


The BS16 feature allows the Am386DX/DXL micropro- 
cessor to directly connect to 32- and 16-bit data buses. 
Asserting this input constrains the current bus cycle to 
use only the lower-order half (D15—D0) of the data bus, 
corresponding to BEO and BE7. Asserting BS16 has no 
additional effect if only BEO and/or BE1 are asserted in 
the current cycle. However, during bus cycles asserting 
BE2orBE3, asserting BS16 will automatically cause the 
Am386DX/DXL microprocessor to make adjustments 
for correct transfer of the upper byte(s) using only physi- 
cal data signals D15—D0. 








If the operand spans both halves of the data bus and 
BS16 is asserted, the Am386DX/DXL microprocessor 
will automatically perform another 16-bit bus cycle. 
BS16 must always meet setup and hold times, t17 and 
t18, for correct operation. 


Am386DX/DXL CPU I/O cycles are automatically gen- 
erated for coprocessor communication. Since the 
Am386DX/DXL microprocessor must transfer 32-bit 
quantities between itself and a 387DX math coproces- 
sor, BS16 must not be asserted during 387DX math 
coprocessor communication cycles. 


Bus Arbitration Signals (HOLD, HLDA) 
Introduction 











This section describes the mechanism by which the 
processor relinquishes control of its local buses when 
requested by another bus master device. See 
Entering and Exiting Hold Acknowledge for additional 
information. 
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Bus Hold Request (HOLD) 


This input indicates some device other than the 
Am386DX/DXL CPU requires bus mastership. 


HOLD must remain asserted as long as any other de- 
vice is a local bus master. HOLD is not recognized while 
RESET is asserted. If RESET is asserted while HOLD is 
asserted, RESET has priority and places the bus into an 
idle state, rather than the hold acknowledge (high 
impedance) state. HOLD is level-sensitive and is a syn- 
chronous input. HOLD signals must always meet setup 
and hold times, t23 and t24, for correct operation. 


Bus Hold Acknowledge (HLDA) 


Assertion of this output indicates the Am3886DX/DXL 
microprocessor has relinquished control of its local bus 
in response to HOLD asserted, and is in the Bus Hold 
Acknowledge state. 


The Hold Acknowledge state offers near-compiete sig- 
nal isolation. In the Hold Acknowledge state, HLDA is 
the only signal being driven by the Am386DX/DXL mi- 
croprocessor. The other output signals or bidirectional 
signals (D31-D0, BE3—BE0, A31—A2, W/R, D/C, M/IO, 
LOCK, and ADS) are in a high-impedance state so the 
requesting bus master may control them. Pull-up resis- 
tors may be desired on several signals to avoid spurious 
activity when no bus master is driving them. See Resis- 
tor Recommendations. Also, one rising edge occurring 
~on the NMI input during Hold Acknowledge is remem- 
bered for processing after the HOLD input is negated. 


In addition to the normal usage of Hold Acknowledge 
with DMA controllers or master peripherals, the near- 
complete isolation has particular attractiveness during 
system test when test equipment drives the system and 
in hardware-fault-tolerant applications. 


Coprocessor Interface Signals (PEREQ, BUSY, 
ERROR) 


Introduction 





Inthe following sections are descriptions of signals dedi- 
cated to the numeric coprocessor interface. In addition 
to the data bus, address bus, and bus cycle definition 
signals, these following signals control communication 
between the Am386DX/DXL microprocessor and its 
387DX math coprocessor extension. 


Coprocessor Request (PEREQ) 


When asserted, this input signal indicates a coproces- 
sor request for a data operand to be transferred to/from 
memory by the Am386DX/DXL microprocessor. In re- 
sponse, the Am386DX/DXL CPU transfers information 
between the coprocessor and memory. Because 
Am386DX/DXL microprocessor has internally stored 
the coprocessor op-code being executed, it performs 
the requested data transfer with the correct direction 
and memory address. 


PEREQ is level-sensitive and is allowed to be asynchro- 
nous to the CLK2 signal. 


Coprocessor Busy (BUSY) 


When asserted, this input indicates the coprocessor is 
still executing an instruction and is not yet able to accept 
another. When the Am386DX/DXL microprocessor en- 
counters any coprocessor instruction that operates on 
the numeric stack (e.g., load, pop, or arithmetic opera- 
tion) or the WAIT instruction, this input is first automati- 
cally sampled until it is seen to be negated. This sam- 
pling of the BUSY input prevents overrunning the execu- 
tion of a previous coprocessor instruction. 





The FNINIT and FNCLEX coprocessor instructions are 
allowed to execute even if BUSY is asserted, since 
these instructions are used for coprocessor initialization 
and exception-clearing. 





BUSY is level-sensitive and is allowed to be asynchro- 
nous to the CLK2 signal. 


BUSY serves an additional function. If BUSY is sampled 
Low at the falling edge of RESET, the Am386DX/DXL 
microprocessor performs an internal self-test (see Bus 
Activity During and Following Reset). If BUSY is sam- 
pled High, no self-test is performed. 








Coprocessor Error (ERROR) 


This input signal indicates that the previous coprocessor 
instruction generated a coprocessor error of a type 
not masked by the coprocessor’s control register. This 
input is automatically sampled by the Am3886DX/DXL 
microprocessor when a coprocessor instruction is en- 
countered, and if asserted, the Am386DX/DXL device 
generates Exception 16 to access the error-handling 
software. 


Several coprocessor instructions, generally those that 
clear the numeric error flags in the coprocessor or 
save coprocessor state, do execute without the 
Am386DX/DXL microprocessor generating Exception 
16 even if ERROR is asserted. These instructions are 
FNINIT, FNCLEX, FSTSW, FSTSWAX, FSTCW, 
FSTENV, FSAVE, FESTENV, and FESAVE. 


ERROR is level-sensitive and is allowed to be asynchro- 
nous to the CLK2 signal. 


Interrupt Signals (INTR, NMI, RESET) 
Introduction 





The following descriptions cover inputs that can inter- 
rupt or suspend execution of the processor’s current 
instruction stream. 


Maskable Interrupt Request (INTR) 


When asserted, this input indicates a request for inter- 
rupt service, which can be masked by the Am386DX/ 
DXL CPU Flag Register IF bit. When the Am386DX/DXL 
microprocessor responds to the INTR input, it performs 
two interrupt acknowledge bus cycles, and at the end of 
the second, latches an 8-bit interrupt vector on D17—D0 
to identify the source of the interrupt. 
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INTR is level-sensitive and is allowed to be asynchro- 
nous to the CLK2 signal. To assure recognition of an 
INTR request, INTR should remain asserted until the 
first interrupt acknowledge bus cycle begins. 


Non-Maskable Interrupt Request (NMI) 


This input indicates a request for interrupt service, which 
cannot be masked by software. The non-maskable in- 
terrupt request is always processed according to the 
pointer or gate in slot 2 of the interrupt table. Because of 
the fixed NMI slot assignment, no interrupt acknowledge 
cycles are performed when processing NMI. 


NMI is rising edge-sensitive and is allowed to be asyn- 
chronous to the CLK2 signal. To assure recognition of 
NMI, it must be negated for at least eight CLK2 periods, 
and then be asserted for at least eight CLK2 periods. 


Once NMI processing has begun, no additional NMI’s 
are processed until after the next IRET instruction, 
which is typically the end of the NMI service routine. If 
NMI is re-asserted prior to that time, however, one rising 
edge on NMI will be remembered for processing after 
executing the next IRET instruction. 


Reset (RESET) 


This input signal suspends any operation in progress 
and places the Am386DX/DXL microprocessor in a 
known reset state. The Am3886DX/DXL device is reset 
by asserting RESET for 15 or more CLK2 periods (80 or 
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more CLK2 periods before requesting self-test). When 
RESET is asserted, all other input pins, except FLT, are 
ignored, and all other bus pins are driven to an idle bus 
state as shown in Table 15. lf RESET and HOLD are 
both asserted at a point in time, RESET takes priority 
even if the Am386DX/DXL device was in a Hold Ac- 
knowledge state prior to RESET asserted. 


RESET is level-sensitive and must be synchronous to 
the CLK2 signal. If desired, the phase of the internal 
processor clock and the entire Am386DX/DXL CPU 
state can be completely synchronized to external cir- 
cuitry by ensuring the RESET signal falling edge meets 
its applicable setup and hold times, t25 and t26. The 
signal summary is shown in Table 16. 


Table 15. Pin State (Idle Bus) During Reset 


| PinName | Signal Level During Reset | 


ADS High 
D31—D0 High Impedance 


BE3-BEO Low 
A31—A2 High 


W/R Low 
D/C High 
M/IO Low 
LOCK High 
HLDA | Low 





Table 16. Am386DX/DXL Microprocessor Signal Summary 


CLK2 Clock 

D31-—D0 Data Bus 

BE3-—BE0 Byte Enables 
Address Bus 
Write-Read Indication 
Data-Control Indication 
Memory-1/O Indication 
Bus Lock Indication 
Address Status 
Next Address Request 
Bus Size 16 
Transfer Acknowledge 
Bus Hold Request 
Bus Hold Acknowledge 
Coprocessor Request 
Coprocessor Busy 
Coprocessor Error 
Maskable Interrupt Request 
Non-Maskable Intrpt Request | 
Reset | 


Input Synch Output High 
or Asynch to Impedance During 
CLK2 | HLDA? 


—~-—--—---—--0O----o00000006- 
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Bus Transfer Mechanism 
Introduction 


All data transfers occur as a result of one or more bus 
cycles. Logical data operands of byte, word, and Dword 
lengths may be transferred without restrictions on 
physical address alignment. Any byte boundary may be 
used, although two or even three physical bus cycles 
are performed as required for unaligned operand 
transfers. See Dynamic Data Bus Sizing and Operand 
Alignment. 


The Am386DX/DXL microprocessor address signals 
are designed to simplify external system hardware. 
Higher-order address bits are provided by A31-—A2. 
Lower-order address in the form of BE3—BEO0 directly 
provides linear selects for the four bytes of the 32-bit 
data bus. Physical operand size information is thereby 
implicitly provided for each bus cycie in the most usable 
form. 


Byte Enable outputs, BE3-BEO, are asserted when their 
associated data bus bytes are involved with the present 
bus cycle, as listed in Table 17. During a bus cycle, any 
possible pattern of contiguous asserted Byte Enable 
outputs can occur, but never patterns having a negated 
Byte Enable separating two or three asserted Enables. 


Address bits AO and At of the physical operand’s 
base address can be created when necessary (for 





K — Map for AO Signal 


Figure 43. Logic to Generate AO, A1 from 
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instance, for MULTIBUS | or MULTIBUS Il interface), as 
a function of the lowest-order asserted Byte Enable. 
This is shown by Table 18. Logic to generate AO and A1 
is given by Figure 43. 


Table 17. Byte Enables and Associated 
Data and Operand Bytes 


Byte Enable Signal| Associated Data Bus Signals | 
D7-—DO (Byte 0O—least significant) 
D15—D8 (Byte 1) 


D23—D16 (Byte 2) 
| D31—D24 (Byte 3—most significant)| 





Each bus cycle is composed of at least two bus states 
and each bus state requires one processor clock period. 
Additional bus states added to a single bus cycle are 
called wait states. See Bus Functional Description. 


Since a bus cycle requires a minimum of two bus 
states (equal to two processor clock periods), data can 
be transferred between external devices and the 
Am386DX/DXL CPU at a maximum rate of one 4-byte 
Dword every two processor clock periods, for a 
maximum bus bandwidth of 80 Mb/s (Am386DX/DXL 
microprocessor operating at 40-MHz processor clock 
rate). 


w 
m 
© 


At 


w 
bh 


w 
m 
o>) 


AO 


88) 
mM 
ae) 


| 


w 
m 
jo) 


w 
LA 


15021B—046 


E3—BE0 


Am386 Microprocessors for Personal Computers 


AMD cl 


Table 18. Generating A31—A0 from BE3—BE0 and A31-—A2 


Am386DX/DXL CPU Address Signals 


Pe Pe 








FFFFFFFFH 
Not 
Accessible . 
Physical | 
| 800000FFH 
Memory 800000F8H Sabo 
4 Gb (See note) 
Not 
Accessible . 
OOOOFFFFH 
Accessible 
Programmed 
I/O Space 
00000000H 00000000H 
Physical Memory Space I/O Space 


Note: Since A31 is High during automatic communication with coprocessor, A31 High and M/IO Low can be used to 
easily generate a coprocessor select signal. 


15021B—047 


Figure 44, Physical Memory and I/O Spaces 
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Memory and I/O Spaces 


Bus cycles may access physical memory space or I/O 
space. Peripheral devices in the system may either be 
memory-mapped, or I/O-mapped, or both. As shown in 
Figure 44, physical memory addresses range from 
00000000H to FFFFFFFFH (4 Gb) and I/O addresses 
from O0Q000000H to OOOOFFFFH (64 Kb) for pro- 
grammed I/O. Note the I/O addresses used by the auto- 
matic I/O cycles for coprocessor communication are 
800000F8H to 800000FFH, beyond the address range 
of programmed 1/O, to allow easy generation of a 


coprocessor chip select signal using the A31 and MO 


signals. 
Memory and I/O Organization 


The Am386DX/DXL microprocessor datapath to mem- 
ory and I/O spaces can be 32- or 16-bits wide. When 
32-bits wide, memory and I/O spaces are organized 
naturally as arrays of physical 32-bit Dwords. Each 
memory or I/O Dword has four individually addressable 
bytes at consecutive byte addresses. The lowest-ad- 
dressed byte is associated with data signals D17—D0; 
the highest-addressed byte with D31—D24. 


The Am386DX/DXL microprocessor includes a bus 
control input, BS16, that also allows direct connection to 
16-bit memory or I/O spaces organized as a sequence 
of 16-bit word. Cycles to 32- and 16-bit memory or I/O 
devices may occur in any sequence, since the BS16 
control is sampled during each bus cycle. (See Dynamic 
Data Bus Sizing.) The Byte Enable signals, BE3—BEO, 
allow byte granularity when addressing any memory or 
I/O structure, whether 32- or 16-bits wide. 


Dynamic Data Bus Sizing 


Dynamic Data Bus Sizing is a feature allowing direct 
processor connection to 32- or 16-bit data buses for 
memory or I/O. A single processor may connect to both 
size buses. Transfers to or from 32- or 16-bit ports are 
supported by dynamically determining the bus width 
during each bus cycle. During each bus cycle an 
address decoding circuit or the slave device itself may 
assert BS16 for 16-bit ports, or negate BS16 for 32-bit 
ports. 








With BS16 asserted, the processor automatically 
converts operand transfers larger than 16 bits, or mis- 
aligned 16-bit transfers, into two or three transfers as 
required. All operand transfers physically occur on 
D15—D0 when BS16 is asserted. Therefore, 16-bit 
memories or I/O devices only connect on data signals 
D15—D0. No extra transceivers are required. 





Asserting BS16 only affects the processor when BE2 
and/or BE3 are asserted during the current cycle. If only 
D15—D0 are involved with the transfer, asserting BS16 
has no affect since the transfer can proceed normally 
over a 16-bit bus whether BS16 is asserted or not. In 
other words, asserting BS16 has no effect when only the 
lower half of the bus is involved with the current cycle. 











There are two types of situations where the processor is 
affected by asserting BS16, depending on which Byte 
Enables are asserted during the current bus cycle. 





Upper Half Only: 
Only BE2 and/or BES asserted. 


Upper and Lower Half: 


At least BE1, BE2 asserted (and perhaps also 
BEO and/or BE3). 


Effect of asserting BS16 during Upper Half Only read 
cycles: 


Asserting BS16 during Upper Half Only reads causes the 
Am386DX/DXL microprocessor to read data on the lower 
16 bits of the data bus and ignore data on the upper 16 bits 
of the data bus. Data that would have been read from 
D31—D16 (as indicated by BE2 and BES) will instead be 
read from D15—D0, respectively. 


Effect of asserting BS16 during Upper Half Only write 

cycles: 
Asserting BS16 during Upper Half Only writes does not af- 
fect the Am386DX/DXL microprocessor. When only BE2 
and/or BES are asserted during a Write cycle, the 
Am386DX/DXL microprocessor always duplicates data 
signals D31—D16 onto D15—D0 (see Table 13). Therefore, 
no further Am386DX/DXL CPU action is required to per- 
form these writes on 32- or 16-bit buses. 


Effect of asserting BS16 during Upper and Lower Half 
read cycles: 


Asserting BS16 during Upper and fewer ‘Half reads 
causes the processor to perform two 16-bit read cycles for 
complete physical operand transfer. Bytes 0 and 1 (as in- 
dicated by BEO and BE?) are read on the first cycle using 
D15—Do. Bytes 2 and 3 (as indicated by BE2 and BES) are 
read during the second cycle, again using, D15—Do. 
D31—D16 are ignored during both 16-bit cycles. BEO and 
BE? are always negated during the second 16- bit cycle. 
See Figure 54 Cycles 2 and 2a. 


Effect of asserting BS16 during Upper and Lower Half 
write cycles: 


Asserting BS16 during Upper and Lower Half writes 
causes the Am386DX/DXL microprocessor to perform two 
16-bit write cycles for complete physical operand transfer. 
All bytes are available the first write cycle allowing external 
hardware to receive Bytes 0 and 1 (as indicated by BEO 
and BE1) using D15—-DO. On the second cycle the 
Am386DX/DXL microprocessor duplicates Bytes 2 and 3 
on D15—D0 and Bytes 2 and 3 (as indicated by BE2 and 
BES) are written using D15—DO. BEO and BE1 are always 
negated during the second 16-bit cycle. BS16 must be as- 
serted during the second 16-bit cycle. See Figure 54 Cy- 
cles 1 and 1a. 


Interfacing with 32- and 16-Bit Memories 


In 32-bit-wide physical memories such as Figure 45, 
each physical Dword begins at a byte address that is a 
multiple of 4. A31—A2 are directly used as a Dword 
selects and BE3-BEO as byte selects. BS16 is negated 
for all bus cycles involving the 32-bit array. 
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When 16-bit-wide physical arrays are included in the 
system, as in Figure 46, each 16-bit physical word be- 
gins at an address that is a multiple of 2. Note the ad- 
dress is decoded to assert BS16 only during bus cycles 
involving the 16-bit array. If desiring to use pipelined 
address with 16-bit memories, then BE3—BE0O and W/R 
are also decoded to determine when BS16 should be 
asserted. (See Pipelined Address with Dynamic Data 
Bus Sizing.) 





A31-—A2 are directly usable for addressing 32- and 
16-bit devices. To address 16-bit devices, A1 and two 
Byte Enable signals are also needed. 


32 Data Bus (D31—D0) 





AMD cl 


To generate an A1 signal and two Byte Enable signals 
for 16-bit access, BE3-BE0 should be decoded as in 
Table 19. Note that certain combinations of BE3—BE0O 
are never generated by the Am386DX/DXL micropro- 
cessor, leading to “don’t care” conditions in the decoder. 
Any BE3-BE0 decoder, such as shown in Figure 47, 
may use the non-occurring BE3—BE0 combinations to 
its best advantage. 


Am386DX/DXL ee 32-Bit 
Microprocessor Address Bus (BE3—BE0, A31—A2) Memory 




















Figure 45. Am386DX/DXL Microprocessor with 32-Bit Memory 15021B-048 
Data Bus (D31—D0) 
32 
Am386DX/DXL (Ne aetie_A 32-Bit 
Microprocessor Address Bus Memory 
(BE3-BEO, A31-A2) 
Add 
Address Bus (A31—A2) 16-Bit 
Memory 
(BE3—BE0) (BHE, BLE, A1) 
15021B-049 


Figure 46. Am386DX/DXL Microprocessor with 32-Bit and 16-Bit Memory 
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Table 19. Generating A1, BHE, and BLE for Addressing 16-Bit Devices 


Am386DX/DXL CPU Signals 


16-Bit Bus Signals 


ses [ees [ser [ceo [ar | ore | ate cao | 


* 
+ 
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H* 


a fi i 


— 
* 


H 
H 
H 
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H 
H 
H 
H 
L 
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ce xk atx xX 2 xa e 
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BLE asserted when D7—D0O of 16-bit bus is active. 
BHE asserted when D15—D8 of 16-bit bus is active. 
A1 Low for all even words; A1 High for all odd words. 


Key: X = “Don’t Care” 
H = High voltage level 
L =Low voltage level 





X—no active bytes 


X—non-contiguous bytes 


X—non-contiguous bytes 
X—non-contiguous bytes 
X—non-contiguous bytes 


X—non-contiguous bytes 


m™oeKT KhKK KT oC KO eT Te XK 


* =A non-occurring pattern of Byte Enables; either none are asserted or the pattern has Byte Enables asserted for non-contiguous bytes. 


Operand Alignment 


With the flexibility of memory addressing on the 
Am386DX/DXL microprocessor, itis possible to transfer 
a logical operand that spans more than one phy- 
sical Dword or Word of memory or I/O. Examples are 
32-bit Dword operands beginning at addresses not 
evenly divisible by 4- or a 16-bit Word operand split 
between two physical Dwords of memory array. 


Operand alignment and data bus size dictates when 
multiple bus cycles are required. Table 20 describes the 
transfer cycles generated for all combinations of logical 
operand lengths, alignment, and data bus sizing. When 
multiple bus cycles are required to transfer a multi-byte 
logical operand, the highest-order bytes are transferred 
first (but if BS16 asserted requires two 16-bit cycles be 
performed, that part of the transfer is lowest-order first). 


Bus Functional Description 
Introduction 





The Am386DX/DXL microprocessor has separate, par- 
allel buses for data and address. The data bus is 32 bits 
in width and is bidirectional. The address bus provides 
a 32-bit value using 30 signals for the 30 upper-order 
address bits and 4 Byte Enable signals to directly indi- 
cate the active bytes. These buses are interpreted and 
controlled via several associated definition or control 
signals. 


The definition of each bus cycle is given by three defini- 
tion signals: M/IO, W/R, and D/C. At the same time, a 
valid address is present on the Byte Enable signals 
BE3-BEO and other address signals, A31—A2. A status 
signal, ADS, indicates when the Am3886DX/DXL CPU 
issues a new bus cycle definition and address. 


Collectively, the address bus, data bus, and all associ- 
ated control signals are referred to simply as the bus. 


When active, the bus performs one of the bus cycles 
below. 

1. Read from memory space. 

. Locked read from memory space. 

. Write to memory space. 

. Locked write to memory space. 

. Read from |/O space (or coprocessor). 

. Write to I/O space (or coprocessor). 

. Interrupt acknowledge. 

. Indicate halt or indicate shutdown. 


OND OF fh WO ND 


Table 14 shows the encoding of the bus cycle definition 
signals for each bus cycle. See Section Bus Cycle 
Definition. 


The data bus has a dynamic sizing feature supporting 
32- and 16-bit bus size. Data bus size is indicated to the 
Am386DX/DXL microprocessor using its Bus Size 16 
(BS16) input. All bus functions can be performed with 
either data bus size. 


78 Am386 Microprocessors for Personal Computers 


AMD cl 


as | At 
BE1 

BE1 BHE 
BES 





BLE (or AO) 





K — Map for 16-bit BLE signal (same as AO signal in Figure 43). 15021B-050 


Figure 47. Logic to Generate A1, BHE, and BLE for 16-Bit Buses 


Table 20. Transfer Bus Cycles for Bytes, Words, and Dwords 


Physical Byte Address in Memory (low-order bits) 


Transfer Cycles over 32-bit Data Bus 


Transfer Cycles over 16-bit Data Bus 





Key: b= Byte transfer 3=3-byte transfer 
w= Word transfer d= Dword transfer 
|= low-order portion h=high-order portion 
m= mid-order portion x=Don't care 





= BS16 asserted causes second bus cycle. 
*For this case, 8086, 8088, 80186, 80188, 80286 transfer lb first, then hb. 


Am386DX/DXL Microprocessor Data Sheet 79 








zl AMD 


Cycle 1 
Non-Pipelined 
(Read) 


CLK2 (Input) 


—t—4 
oe 
ane 


<_vaigt 


M/0, BE3-BEO, 
A31—A2, D/C, W/R 
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Fastest non-pipelined bus cycles consist of T1 and T2 
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Figure 48. Fastest Read Cycles with Non-Pipelined Address Timing 


When the Am386DX/DXL CPU bus is not performing 


one of the activities listed above, it is either Idle or in the 
Hold Acknowledge state, which may be detected by ex- 
ternal circuitry. The Idle state can be identified by the 
Am386DX/DXL microprocessor giving no further asser- 
tions on its address strobe output (ADS) since the begin- 
ning of its most recent bus cycle, and the most recent 
bus cycle has been terminated. The Hold Acknowledge 
state is identified by the Am386DX/DXL CPU asserting 
its Hold Acknowledge (HLDA) output. 


The shortest time unit of bus activity is abus state. Abus 
state is one processor clock period (two CLK2 periods) 
in duration. A complete data transfer occurs during a 
bus cycle, composed of two or more bus states. 


The fastest Am386DX/DXL microprocessor bus cycle 
requires only two bus states. For example, three con- 
secutive bus read cycles, each consisting of two bus 


states, are shown by Figure 48. The bus states in each 


cycle arenamed T1 and T2. Any memory or I/O address 
may be accessed by such a two-state bus cycle, if the 
external hardware is fast enough. The high-bandwidth, 
two-clock bus cycle realizes the full potential of fast main 
memory, or cache memory. 


Every bus cycle continues until it is acknowledged 
by the external system hardware, using the Am386DX/ 
DXL microprocessor READY input. Acknowledging the 
bus cycle at the end of the first T2 results in the shortest 





bus cycle, requiring only T1 and T2. If READY is not 
immediately asserted, however, T2 states are repeated 
indefinitely until the READY input is sampled asserted. 


Address Pipelining 





The address pipelining option provides a choice of bus 
cycle timings. Pipelined or non-pipelined address timing 
is selectable on a cycle-by-cycle basis with the Next 
Address (NA) input. 


When address pipelining is not selected, the current ad- 
dress and bus cycle definition remain stable throughout 
the bus cycle. 


When address pipelining is selected, the address 
(BE3—-BEO, A31—A2) and definition (W/R, D/C, and 
M/IO) of the next cycle are available before the end of 
the current cycle. To signal their availability, the 
Am386DX/DXL microprocessor address status output 
(ADS) is also asserted. Figure 49 illustrates the fastest 
read cycles with pipelined address timing. 


Note from Figure 49, the fastest bus cycles using 
pipelined address require only two bus states, named 
T1P and T2P. Therefore, cycles with pipelined address 
timing allow the same data bandwidth as non-pipelined 
cycles, but address-to-data access time is increased 
compared to that of a non-pipelined cycle. 
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Fastest pipelined bus cycles consist of T1P and T2P 
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Figure 49. Fastest Read Cycles with Pipelined Address Timing 


By increasing the address-to-data access time, 
pipelined address timing reduces wait state require- 
ments. For example, if one wait state is required with 
non-pipelined address timing, no wait states would be 
required with pipelined address. 


Pipelined address timing is useful in typical systems 
having address latches. In those systems, once an ad- 
dress has been latched, pipelined availability of the next 
address allows decoding circuitry to generate chip se- 
lects (and other necessary select signals) in advance, 
so selected devices are accessed immediately when 
the next cycle begins. In other words, the decode time 
for the next cycle can be overlapped with the end of the 
current cycle. 


If a system contains a memory structure of two or more 
interleaved memory banks, pipelined address timing 
potentially allows even more overlap of activity. This is 
true when the interleaved memory controller is designed 
to allow the next memory operation to begin in one 
memory bank while the current bus cycle is still activat- 
ing another memory bank. Figure 50 shows the general 
structure of the Am386DX/DXL microprocessor with 
two-bank and four-bank interleaved memory. Note each 
memory bank of the interleaved memory has full data 
bus width (32-bit data width typically, unless 16-bit bus 
size is selected). 


Further details of pipelined address timing are given in 
Pipelined Address; Initiating and Maintaining Pipelined 
Address; Pipelined Address with Dynamic Bus Sizing; 
and, Maximum Pipelined Address Usage With 16-bit 
Bus Size. 


Read and Write Cycles 
Introduction 


Data transfers occur as a result of bus cycles, classified 
as Read or Write cycles. During Read cycles, data is 
transferred from an external device to the processor. 


During Write cycles, data is transferred in the other di- 


rection, from the processor to an external device. 


Two choices of address timing are dynamically select- 
able: non-pipelined or pipelined. After a bus idle state, 
the processor always uses non-pipelined address tim- 
ing. However, the NA (Next Address) input may be as- 
serted to select pipelined address timing for the next bus 
cycle. When pipelining is selected and the Am386DX/ 
DXL microprocessor has a bus request pending inter- 
nally, the address and definition of the next cycle is 
made available even before the current bus cycle is 
acknowledged by READY. Generally, the NA input is 
sampled each bus cycle to select the desired address 
timing for the next bus cycle. 
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Two-Bank Interleaved Memory: 
a. Address signal A2 selects bank 
b. 32-bit datapath to each bank 


| Am386DX/DXL | 
CPU 
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Four-Bank Interleaved Memory: 
a. Address signals A3 and A2 select bank 
b. 32-bit datapath to each bank 
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Figure 50. Two-Bank and Four-Bank Interleaved Memory Structure 


Two choices of physical data bus width are dynamically 
selectable: 32 bits or 16 bits. Generally, the BS16 (Bus 
Size 16) input is sampled near the end of the bus cycle to 
confirm the physical data bus size applicable to the 
current cycle. Negation of BS16 indicates a 32-bit size 
and assertion indicates a 16-bit bus size. 


If 16-bit bus size is indicated, the Am3886DX/DXL CPU 
automatically responds as required to complete the 
transfer on a 16-bit data bus. Depending onthe size and 
alignment of the operand, another 16-bit bus cycle may 
be required. Table 19 provides all details. When neces- 
sary, the Am386DX/DXL microprocessor performs an 
additional 16-bit bus cycle, using D15—D0 in place of 
D31—D16. 


Terminating a Read cycle or Write cycle, like any bus cy- 
cle, requires acknowledging the cycle by asserting the 
READY input. Until acknowledged, the processor in- 
serts wait states into the bus cycle to allow adjustment 








forthe speed of any external device. External hardware, 
that has decoded the address and bus cycle type as- 
serts the READY input at the appropriate time. 





At the end of the second bus state within the bus cycle, 
READY is sampled. At that time, if external hardware 
acknowledges the bus cycle by asserting READY, the 
bus cycle terminates as shown in Figure 51. If READY is 
negated as in Figure 52, the cycle continues another 
bus state (a wait state) and READY is sampled again at 
the end of that state. This continues indefinitely until the 
cycle is acknowledged by READY asserted. 











When the current cycle is acknowledged, the 
Am386DX/DXL microprocessor terminates it. When a 
Read cycle is acknowledged, the Am386DX/DXL CPU 
latches the information present at its data pins. When a 
Write cycle is acknowledged, the Am386DX/DXL CPU 
write data remains valid throughout phase one of the 
next bus state to provide write data hold time. 
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Note: Idle states are shown here for diagram variety only. Write cycles are not always followed by an idle state. An active bus cycle can 


immediately follow the write cycle. 
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Figure 51. Various Bus Cycles and Idle States with Non-Pipelined Address (Zero Wait States) 


Non-Pipelined Address 


Any bus cycle may be performed with non-pipelined ad- 
dress timing. For example, Figure 51 shows a mixture of 
Read and Write cycles with non-pipelined address tim- 
ing. Figure 51 shows that the fastest possible cycles 
with non-pipelined address have two bus states per bus 
cycle. The states are named T1 and T2. In phase one of 
the T1, the address signals and bus cycle definition sig- 
nals are driven valid, and to signal their availability, 
address status (ADS) is simultaneously asserted. 


During Read or Write cycles, the data bus behaves as 
follows. If the cycle is a read, the Am3886DX/DXL micro- 
processor floats its data signals to allow driving by the 
external device being addressed. The Am386DX/DXL 
device requires that all data bus pins be at a valid logic 
state (High or Low) at the end of each read cycle, when 
READY is asserted, even if all byte enables are not as- 
serted. The system must be designed to meet this re- 
quirement. If the cycle is a write, data signals are driven 
by the Am386DX/DXL device beginning in phase two of 
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T1 until phase one of the bus state following cycle 
acknowledgment. 


Figure 52 illustrates non-pipelined bus cycles with one 
wait added to Cycles 2 and 3. READY is sampled 
negated at the end of the first T2 in Cycles 2 and 3. 
Therefore, Cycles 2 and 3 have T2 repeated. At the end 
of the second T2, READY is sampled asserted. 








When address pipelining is not used, the address and 
bus cycle definition remain valid during all wait states. 








When wait states are added and you desire to maintain 
non-pipelined address timing, it is necessary to negate 


NA during each T2 state except the last one, as shownin 


Figure 52 Cycles 2 and 3. If NA is sampled asserted 
during a T2 other than the last one, the next state 
would be T2I (for pipelined address) or T2P (for pipe- 
lined address) instead of another T2 (for non-pipelined 
address). 
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Note: Idle states are shown here for diagram variety only. Write cycles are not always followed by an idle state. An active bus cycle can 


immediately follow the Write cycle. 
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Figure 52. Various Bus Cycies and idle States with Non-Pipelined Address 
(Various Number of Wait States) 
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T1— First clock of a non-pipelined bus cycle (Am386DX/DXL microprocessor drives new address and asserts ADS). 
T2— Subsequent clocks of a bus cycle when NA has not been sampled asserted in the current bus cycle. 


Ti — Idle state. 


Th— Hold Acknowledge state (Am386DX/DXL microprocessor asserts HLDA). 


The fastest bus cycle consists of two states: T1 and T2. 
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Four basic bus states describe bus operation when not using pipelined address. These states do include BS16 usage for 32-bit and 16-bit bus 
size. If asserting BS16 requires second 16-bit bus cycle to be performed, it is performed before HOLD asserted acknowledged. 





Figure 53. Bus States (Not Using Pipelined Address) 


Figure 53 illustrates the bus states and transitions when 
address pipelining is not used. The bus transitions be- 
tween four possible states: T1, T2, Ti, and Th. Bus cy- 
cles consist of T1 and T2, with T2 being repeated for 
wait states. Otherwise, the bus may be idle in the Ti 
state, or in hold acknowledge, the Th state. 


When address pipelining is not used, the bus state dia- 
gram is as shown in Figure 53. When the bus is idle, itis 
in state Ti. Bus cycles always begin with T1. T1 always 
leads to T2. Ifa bus cycle is not acknowledged during T2 
and NA is negated, T2 is repeated. When a cycle is ac- 
knowledged during T2, the following state will be T1 of 
the next bus cycle if a bus request is pending internally, 
or Ti if there is no bus request pending, or Th if the 
HOLD input is being asserted. 


The bus state diagram in Figure 53 also applies to the 
use of BS16. If the Am386DX/DXL microprocessor 
makes internal adjustments for 16-bit bus size, the 
adjustments do not affect the external bus states. If an 
additional 16-bit bus cycle is required to complete a 
transfer on a 16-bit bus, it also follows the state transi- 
tions shown in Figure 53. 


Use of pipelined address allows the Am3886DX/DXL 
CPU to enter three additional bus states not shown 
in Figure 53. Figure 59 in Pipelined Address is the com- 
plete bus state diagram, including pipelined address 
cycles. 


Non-Pipelined Address With Dynamic Data Bus 
Sizing 

The physical data bus width for any non-pipelined bus 
cycle can be either 32 or 16 bits. At the beginning of the 
bus cycle, the processor behaves as if the data bus is 
32-bits wide. When the bus cycle is acknowledged by 
asserting READY at the end of a T2 state, the most 
recent sampling of BS16 determines the data bus size 
for the cycle being acknowledged. If BS16 was most re- 
cently negated, the physical data bus size is defined as 
32 bits. If BS16 was most recently asserted, the size is 
defined as 16 bits. 


When BS 16 is asserted and two 16-bit bus cycles are re- 
quired to complete the transfer, BS16 must be asserted 
during the second cycle; 16-bit bus size is not assumed. 
Like any bus cycle, the second 16-bit cycle must be ac- 
knowledged by asserting READY. 
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Figure 54. Asserting BS16 (Zero-Wait-States, Non-Pipelined Address) 
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Figure 55. Asserting BS16 (One-Wait-State, Non-Pipelined Address) 
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When a second 16-bit bus cycle is required to complete 
the transfer over a 16-bit bus, the addresses generated 
for the two 16-bit bus cycles are closely related to each 
other. The addresses are the same, except BEO and 
BE7 are always negated for the second cycle. This is be- 
cause data on D15—D0 was already transferred during 
the first 16-bit cycle. 


Figures 54 and 55 show cases where assertion of BS16 
requires a second 16-bit cycle for complete operand 
transfer. Figure 54 illustrates cycles without wait states. 
Figure 55 illustrates cycles with one wait state. In Figure 
55 Cycle 1, the bus cycle during which BS16 is asserted, 
note that NA must be negated in the T2 state(s) prior to 
the last T2 state. This is to allow the recognition of BS16 
asserted in the final T2 state. The relation of NA and 
BS16 is given fully in Pipelined Address, but Figure 55 
illustrates this only precaution you need to know when 
using BS16 with non-pipelined address. 


Pipelined Address 











Address pipelining is the option of requesting the ad- 
dress and the bus cycle definition of the next internally 
pending bus cycle before the current bus cycle is 
acknowledged with READY asserted. ADS is asserted 
by the Am386DX/DXL microprocessor when the next 
address is issued. The address pipelining option is 
controlled on a cycle-by-cycle basis with the NA input 
signal. 


Once a bus cycle is in progress and the current address 
has been valid for at least one entire bus state, the NA 
input is sampled at the end of every phase one until the 
bus cycle is acknowledged. During non-pipelined bus 
cycles, therefore, NAis sampled atthe end of phase one 
in every T2. An example is Cycle 2 in Figure 56, during 
which NA is sampled at the end of phase one of every 
T2 (it was asserted once during the first T2 and has no 
further effect during that bus cycle). 


lf NA is sampled asserted, the Am386DX/DXL micro- 
processor is free to drive the address and bus cycle defi- 
nition of the next bus cycle, and assert ADS, as soon as 
it has a bus request internally pending. It may drive the 
next address as early as the next bus state, whether the 
current bus cycle is acknowledged at that time or not. 


Regarding the details of address pipelining, the 
Am386DX/DXL CPU has the following characteristics. 


1. For NA to be sampled asserted, BS16 must be 
negated at the sampling window (see Figure 56 
Cycles 2 through 4, and Figure 57 Cycles 1 through 
4). If NA and BS16 are both sampled asserted during 





the last T2 period of a bus cycle, BS16 asserted has 
priority. Therefore, if both are asserted, the current 
bus size is taken to be 16 bits and the next address is 
not pipelined. 


2. The next address may appear as early as the bus 
state after NA was sampled asserted (see Figure 56 
or 57). In that case, state T2P is entered immedi- 
ately, However, when there is not an internal bus 
request already pending, the next address will not be 
available immediately after NA is asserted and T2I 
is entered instead of T2P (see Figure 58 Cycle 3). 
Provided the current bus cycle is not yet acknow- 
ledged by READY asserted, T2P will be entered as 
soon as the Am386DX/DXL microprocessor does 
drive the next address. External hardware should 
therefore observe the ADS output as confirmation 
the next address is actually being driven on the bus. 


3. Once NA is sampled asserted, the Am386DX/DXL 
microprocessor commits itself to the highest priority 
bus request that is pending internally. It can no 
longer perform another 16-bit transfer to the same 
address should BS16 be asserted externally, so 
thereafter must assume the current bus size is 32 
bits. Therefore, if NA is sampled asserted within a 
bus cycle, BS16 must be negated thereafter in 
that bus cycle (see Figures 56, 57, 58). Con- 
sequently, do not assert NA during bus cycles that 
must have BS16 driven asserted. See Dynamic Bus 
Sizing with Pipelined Address. 


4. Any address which is validated by a pulse on the 
Am386DX/DXL CPU ADS output will remain stable 
on the address pins for at least two processor clock 
periods. The Am386DX/DXL microprocessor cannot 
produce a new address more frequently than every 
two processor clock periods (See Figures 56, 57, 58). 


5. Only the address and bus cycle definition of the very 
next bus cycle is available. The pipelining capability 
cannot look further than one bus cycle ahead (see 
Figure 58 Cycle 1). 


The complete bus state transition diagram, including op- 
eration with pipelined address is given by Figure 59. 
Note it is a superset of the diagram for non-pipelined 
address only and the three additional bus states for 
pipelined address are drawn in bold. 














The fastest bus cycle with pipelined address consists of 
just two bus states, T1P and T2P (recall for non- 
pipelined address it is T1 and T2). T1P is the first bus 
state of a pipelined cycle. 
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Note: Following any idle bus state (Ti), addresses are non-pipelined. Within non-pipelined bus cycles, NA is only sampled during wait 
states. Therefore, to begin address pipelining during a group of non-pipelined bus cycles requires a non-pipelined cycle with at least 
one wait state (Cycle 2 above). 
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Figure 56. Transitioning to Pipelined Address During Burst of Bus Cycles 
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Figure 57. Fastest Transition to Pipelined Address Following Idle Bus State 
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Initiating and Maintaining Pipelined Address 


Using the state diagram Figure 59, observe the transi- 
tions from an idle state, Ti, to the beginning of a 
pipelined bus cycle, T1P. From an idle state Ti, the first 
bus cycle must begin with T1, and is therefore a non- 
pipelined bus cycle. The next bus cycle will be pipelined, 
however, provided NA is asserted and the first bus cycle 
ends in a T2P state (the address forthe next bus cycle is 
driven during T2P). The fastest path from an idle state to 
a bus cycle with pipelined address is shown in below: 


Ti, Ti, Ti T1-T2-T2P T1P-T2P 
ed ed yd 
Idle Non-Pipelined Pipelined 
States Cycle Cycle 


T1-T2-T2P are the states of the bus cycle that estab- 
lishes address pipelining for the next bus cycle, which 
begins with T1P. The same is true after a bus hold state, 
shown below: 


Th, Th, Th T1-T2-T2P T1P-T2P 
——___ ___,-____ 4 
Hold Non-Pipelined Pipelined 
Acknowledge Cycle Cycle 
States 


The transition to pipelined address is shown functionally 
by Figure 57 Cycle 1. Note that Cycle 1 is used to transi- 
tion into pipelined address timing for the subsequent 
Cycles 2, 3, and 4 that are pipelined. The NA input is as- 
serted at the appropriate time to select address pipe- 
lining for Cycles 2, 3, and 4. 


Once a bus cycle is in progress and the current address 
has become valid, the NA input is sampled at the end of 
every phase one, beginning with the next bus state, until 
the bus cycle is acknowledged. During Figure 57 Cycle 
1 therefore, sampling begins in T2. Once NA is sampled 
asserted during the current cycle, the Am386DX/DXL 
microprocessor is free to drive a new address and bus 
cycle definition on the bus as early as the next bus state. 
In Figure 56 Cycle 1 for example, the next address 
is driven during state T2P. Thus, Cycle 1 makes the 
transition to pipelined address timing, since it begins 


AMD cl 


with T1 but ends with T2P. Because the address for Cy- 
cle 2 is available before Cycle 2 begins, Cycle 2 is called 
a pipelined bus cycle, and it begins with T1P. Cycle 2 
begins as soon as READY asserted terminates Cycle 1. 





Example transition bus cycles are Figure 57 Cycle 1 and 
Figure 56 Cycle 2. Figure 57 shows transition during the 
very first cycle after an idle bus state, which is the fastest 
possible transition into address pipelining. Figure 56 
Cycle 2, shows a transition cycle occurring during a 
burst of bus cycles. In any case, a transition cycle is the 
same whenever it occurs: it consists at least of T1, T2 
(you assert NA at that time), and T2P (provided the 
Am386DX/DXL microprocessor has an internal bus 
request already pending, which it almost always has). 
T2P states are repeated if wait states are added to the 
cycle. 


Note three states (T1, T2, and T2P) are only required in 
a bus cycle performing a transition from non-pipelined 
address into pipelined address timing; for example, 
Figure 57 Cycle 1. Figure 57 Cycles 2, 3, and 4 show 
that address pipelining can be maintained with two- 
state bus cycles consisting only of T1P and T2P. 


Once a pipelined bus cycle is in progress, pipelined tim- 
ing is maintained for the next cycle by asserting NA and 
detecting that the Am3886DX/DXL CPU enters T2P dur- 
ing the current bus cycle. The current bus cycle must 
end in state T2P for pipelining to be maintained in the 
next cycle. T2P is identified by the assertion of ADS. Fig- 
ures 56 and 57 however, show pipelining ending after 
Cycle 4, because Cycle 4 ends in T2P. This indicates 
the Am386DX/DXL CPU did not have an internal bus re- 
quest prior to the acknowledgment of Cycle 4. If a cycle 
ends witha T2or T2l, the next cycle will not be pipelined. 


Realistically, address pipelining is almost always main- 
tained as long as NA is sampled asserted. This is so, 
because in the absence of any other request a code 
prefetch request is always internally pending until the 
instruction decoder and code prefetch queue are 
completely full. Therefore, address pipelining is main- 
tained for long bursts of bus cycles, if the bus is available 
(i.e., HOLD negated) and NA is sampled asserted in 
each of the bus cycles. 
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Figure 58. Details of Address Pipelining During Cycles with Wait States 
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Figure 59. Am386DX/DXL Microprocessor Complete Bus States (including Pipelined Address) 
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Pipelined Address With Dynamic Data Bus Sizing 


The BS16 feature allows easy interface to 16-bit data 
buses. When asserted, the Am386DX/DXL micropro- 
cessor bus interface hardware performs appropriate 
action to make the transfer using a 16-bit data bus 
connected on D15—D0. 


There is a degree of interaction, however, between the 
use of Address Pipelining and the use of Bus Size 16. 
The interaction results from the multiple bus cycles re- 
quired when transferring 32-bit operands over a 16-bit 
bus. If the operand requires both 16-bit halves of the 
32-bit bus, the appropriate AmM3886DX/DXL micropro- 
cessor action is a second bus cycle to complete the op- 
erand’s transfer. This necessity conflicts with NA usage. 


When NA is sampled asserted, the Am386DX/DXL mi- 
croprocessor commits itself to perform the next inter- 
nally pending bus request, and is allowed to drive the 
next internally pending address onto the bus. Asserting 
NA therefore makes it impossible for the next bus cycle 
to again access the current address on A31—A2, such as 
may be required when BS 16 is asserted by the external 
hardware. 





To avoid conflict, the Am386DX/DXL microprocessor is 
designed with following two provisions. 


1. To avoid conflict, BS16 must be negated inthe current 
bus cycle if NA has already been sampled asserted 
in the current cycle. If NA is sampled asserted, the 
current data bus size is assumed to be 32 bits. 


2. Also to avoid conflict, if NA and BS16 are both 
asserted during the same sampling window, BS16 
asserted has priority and the Am386DX/DXL micro- 
processor acts as if NA was negated at that time. 


Certain types of 16- or 8-bit operands require no adjust- 
ment for correct transfer on a 16-bit bus. Those are read 
or write operands using only the lower half of the data 
bus, and write operands using only the upper half 
of the bus, since the Am3886DX/DXL CPU simultane- 
ously duplicates the write data on the lower half of the 
data bus. For these patterns of Byte Enables and 
the W/R signals, BS16 need not be asserted at the 
Am386DX/DXL CPU allowing NA to be asserted during 
the bus cycle if desired. 


Interrupt Acknowledge (INTA) Cycles 





In response to an interrupt request on the INTR input 
when interrupts are enabled, the Am386DX/DXL micro- 
processor performs two interrupt acknowledge cycles. 
These bus cycles are similar to read cycles in that bus 
definition signals define the type of bus activity taking 
place, and each cycle continues until acknowledged by 
READY sampled asserted. 


The state of A2 distinguishes the first and second in- 
terrupt acknowledge cycles. The byte address driven 
during the first interrupt acknowledge cycle is 4 (A31— 
A3 Low, A2 High, BE3—BE1 High, and BEO Low). The 
address driven during the second interrupt acknowl- 
edge cycle is 0 (A31-A2 Low, BE3-BE1 High, BEO 
Low). 


The LOCK output is asserted from the beginning of the 
first interrupt acknowledge cycle until the end of the sec- 
ond interrupt acknowledge cycle. Four idle bus states, 
Ti, are inserted by the Am3886DX/DXL microprocessor 
between the two interrupt acknowledge cycles, allowing 
for compatibility with spec TRHRL of the 8259A Interrupt 
Controller. 


During both interrupt acknowledge cycles, D31—D0 
float. No data is read at the end of the first interrupt ac- 
knowledge cycle. At the end of the second interrupt 
acknowledge cycle, the Am386DX/DXL microprocessor 
will read an external interrupt vector from D7—D0O of the 
data bus. The vector indicates the specific interrupt 
number (from 0—255) requiring service. 


Halt Indication Cycle 


The Am386DX/DXL microprocessor halts as a result of 
executing a HALT instruction. Signaling its entrance into 
the halt state, a halt indication cycle is performed. The 


halt indication cycle is identified by the state of the bus 


definition signals shown in Bus cycle Definition and a 
byte address of 2. BEO and BE2 are the only signals 
distinguishing halt indication from shutdown indication, 
that drives an address of 0. During the halt cycle 
undefined data is driven on D31—D0. The halt indication 
cycle must be acknowledged by READY asserted. 


A halted Am386DX/DXL CPU resumes execution when 
INTR (if interrupts are enabled) or NMI or RESET is 
asserted. 


Shutdown Indication Cycle 


The Am386DX/DXL microprocessor shuts down as a 
result of a protection fault while attempting to process a 
double fault. Signaling its entrance into the shutdown 
State, a shutdown indication cycle is performed. The 
shutdown indication cycle is identified by the state of the 
bus definition signals shown in Bus Cycle Definition and 
a byte address of 0. BEO and BE2 are the only signals 
distinguishing shutdown indication from halt indication, 
which drives an address of 2. During the shutdown 
cycle, undefined data is driven on D31—D0. The shut- 
down indication cycle must be acknowledged by 
READY asserted. 


A shutdown Am386DX/DXL microprocessor resumes 
execution when NMI or RESET is asserted. 
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Cycle 1 is pipelined. Cycle 1A cannot be pipelined, but its address can be inferred from 
that of Cycle 1, to externally simulate address pipelining during Cycle 1A. 


15021B-063 
Figure 60. Using NA and BS16 
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Interrupt Vector (0-255) is read on D7—D0 at end of second Interrupt Acknowledge bus cycle. 
Because each Interrupt Acknowledge bus cycle is followed by idle bus states, asserting NA has no practical effect. Choose the 
approach that is simplest for your system hardware design. 
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Figure 61. Interrupt Acknowledge Cycles 
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Figure 62. Halt Indication Cycle 
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Figure 63. Shutdown Indication Cycle 
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Other Functional Descriptions 
Entering and Exiting Hold Acknowledge 


The Bus Hold Acknowledge State, Th, is entered in 
response to the HOLD input being asserted. In the 
Bus Hold Acknowledge state, the Am386DX/DXL 
microprocessor floats all output or bidirectional signals, 
except for HLDA. HLDA is asserted as long as the 
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Am386DX/DXL CPU remains in the bus hold acknowl- 
edge state. In the Bus Hold Acknowledge state, ail in- 
puts except HOLD, FLT, RESET, BUSY, ERROR, and 
PEREQ are ignored (also up to one rising edge on NMI 
is remembered for processing when HOLD is no longer 
asserted). 
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Note: For maximum design flexibility, the Am386DX/DXL CPU has no internal pullup resistors on its outputs. The design may 
require an external pullup on ADS and other Am386DX/DXL CPU outputs to keep them negated during float periods. 
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Figure 64. Requesting Hold from Idle Bus 
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Th may be entered from a bus idle state, as in Figure 64, 
or after the acknowledgment of the current physical bus 
cycle if the LOCK signal is not asserted, as in Figures 65 
and 66. If HOLD is asserted during a locked bus cycle, 
the Am3886DX/DXL microprocessor may execute one 
unlocked bus cycle before acknowledging HOLD. If as- 
serting BS16 requires a second 16-bit bus cycle to com- 
plete a physical operand transfer, it is performed before 
HOLD is acknowledged, although the bus state dia- 
grams in Figures 53 and 59 do not indicate that detail. 








Th is exited in response to the HOLD input being ne- 
gated. The following state will be Ti as in Figure 64 if no 
bus request is pending. The following bus state will be 
T1 if abus request is internally pending, as in Figures 65 
and 66. 


Th is also exited in response to RESET being asserted. 


If a rising edge occurs on the edge-triggered NMI in- 
put while in Th, the event is remembered as a non- 
maskable interrupt 2 and is serviced when Th is exited, 
unless of course, the AmM386DX/DXL microprocessor is 
reset before Th is exited. 


RESET During HOLD Acknowledge 


RESET being asserted takes priority over HOLD being 
asserted. Therefore, Th is exited in response to the 
RESET input being asserted. If RESET is asserted 
while HOLD remains asserted, the Am386DX/DXL mi- 
croprocessor drives its pins to defined states during 
reset, as in Table 15 Pin State During RESET, and 
performs internal reset activity as usual. 


lf HOLD remains asserted when RESET is negated, the 
Am386DX/DXL microprocessor enters the hold ac- 
knowledge state before performing its first bus cycle, 
provided HOLD is still asserted when the Am386DX/ 
DXL microprocessor would otherwise perform its first 
bus cycle. If HOLD remains asserted when RESET is 
negated, the BUSY input is still sampled as usual to de- 
termine whether a self test is being requested, and ER- 
ROR is still sampled as usual to determine whether a 
387DX math coprocessor versus an 80287 (or none) is 
present. 


Float 


Activating the FLT input floats all AmM3886DX/DXL CPU 
bidirectional and output signals, including HLDA. As- 
serting FLT isolates the Am3886DX/DXL CPU from the 
surrounding circuitry. 





As the Am386DX/DXL microprocessor is packaged ina 
surface mount PQFP, it cannot be removed from the 
motherboard when In-Circuit Emulation (ICE) is 
needed. The FLT input allows the Am3886DX/DXL CPU 
to be electrically isolated from the surrounding circuitry. 
This allows connection of an emulator to the Am386DX/ 
DXL microprocessor PQFP without removing it from the 
PCB. This method of emulation is referred to as ON- 
Circuit Emulation (ONCE). 


Entering and Exiting Float 


FLT is an asynchronous, active Low input. It is recog- 
nized on the rising edge of CLK2. When recognized, it 
aborts the current bus cycle and floats the outputs of the 
Am386DX/DXL microprocessor (Figure 68). FLT must 
be held Low for a minimum of 16-CLK2 cycles. Reset 
should be asserted and held asserted until after FLT is 
deasserted. This will ensure that the Am3886DX/DXL 
CPU will exit Float in a valid state. 


Asserting the FLT input unconditionally aborts the cur- 
rent bus cycle and forces the Am386DX/DXL micro- 
processor into the Float mode. Since activating FLT 
unconditionally forces the Am386DX/DXL CPU into 
Float mode, the Am386DX/DXL CPU is not guaranteed 
to enter Float in a valid state. After deactivating FLT, the 
Am386DX/DXL CPU is not guaranteed to exit Float 
mode in a valid state. This is not a problem, as the FLT 
pin is meant to be used only during ONCE. After exiting 
Float, the Am386DX/DXL CPU must be reset to return it 
to a valid state. Reset should be asserted before FLT is 
deasserted. This will ensure that the Am3886DX/DXL 
CPU will exit Float in a valid state. 


FLT has an internal pull-up resistor, and if it is not used it 
should be unconnected. 


Bus Activity During and Following Reset 


RESET is the highest priority input signal capable of in- 
terrupting any processor activity when it is asserted. A 
bus cycle in progress can be aborted at any stage; or 
idle states or bus hold acknowledge states discontinued 
so that the RESET state is established. 


RESET should remain asserted for at least 15-CLK2 
periods to ensure it is recognized throughout the 
Am386DX/DXL microprocessor, and at least 80-CLK2 
periods if Am386DX/DXL device self-test is going to be 
requested at the falling edge. RESET asserted pulses 
less than 15 CLK2 periods may not be recognized. 
RESET pulses less than 80 CLK2 periods followed by 
a self-test may cause the self-test to report a failure 
when no true failure exists. 


The additional RESET pulse width is required to clear 
additional state prior to valid self-test. 


Provided the RESET falling edge meets setup and hold 
times, t25 and t26, the internal processor clock phase is 
defined at that time, as illustrated by Figure 67. 


An Am386DX/DXL microprocessor self-test may be re- 
quested at the time RESET is negated by having the 
BUSY input at a Low level, as shown in Figure 67. The 
self-test requires (2°°) + approximately 60-CLK2 periods 
to complete. The self-test duration is not affected by the 
test results. Even if the self-test indicates a problem, the 
Am386DX/DXL device attempts to proceed with the re- 
set sequence afterward. 
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After the RESET falling edge (and after the self-test if 
it was requested) the Am386DX/DXL microprocessor 
performs an internal initialization sequence for approxi- 
mately 350 to 450 CLK2 periods. 


The Am386DX/DXL microprocessor samples its ER- 
ROR input some time after the falling edge of RESET 
and before executing the first ESC instruction. During 


Cycle 1 
Non-Pipelined 
(Read) 


M/0, BE3-BEO, 
A31-A2, D/C, W/R 


wn ap 
tl... 
Hou [ 
7 
LC KS 
(= 
Y 


Bste [ KIX KK KIX K WI 
BsTé [ XDXXXKX OOD Xp 
Note: If asserting BS16 requires a second 


bus cycle to be performed, the second cy- 
cle is performed before Hold Acknowledge. 


KKXOXVKKY 


READY | X 


COCK [ 


p31-Do [ -4-------- ee eee 
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this sampling period BUSY must be High. lf ERROR 
was sampled active, the Am3886DX/DXL device em- 
ploys the 32-bit protocol of a 387DX math coprocessor. 
Even though this protocol was selected, it is still neces- 
sary to use a software recognition test to determine the 
presence or identity of the coprocessor and to assure 
compatibility with future processors. 


Hold Cycle 2 
Acknowledge Non-Pipelined 
(Write) 
Th Th T1 T2 






HOLD asserted no later 
than READY asserted 










Note: HOLD is a synchronous input and can be asserted at any CLK2 edge, provided setup and hold (t23 and t24) requirements 
are met. This waveform is useful for determining Hold Acknowledge latency. 


15021B—068 


Figure 65. Requesting Hold from Active Bus (NA Negated) 
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Cycle 1 Hold Cycle 2 
Pipelined | Acknowledge Non-Pipelined 


CLK2 
(CLK) 


(Write) | (Read) 
| Th | TI T2 | 
SIX KY TR pe 


[ 
L 
[ 
L 

Mo, BES-8ED, Fb —t}- terres, ... (Feating) | 

A31-A2, D/C, W/R L ate | 1 RK XKKKAD [ 

an See —_ 
L 
L 
L 






HOLD 
HOLD asserted in same bus 
state as NA asserted 






HLDA 






(Floating) 


AD 


” 


KD 3 ADRK POD RAADAKAATKAKAAK XK 


RRKKKKK KKK XXX KK 


XV 






XDOXKKIKKY XA | KKK DOA _| 
(Negated or Last Locked Cycle) : 


voor [DK vais [it ~~ valid 
geen ee ee eas | 
re oD Gl A oe ee =~ <n 


Note: HOLD is a synchronous input and can be asserted at any CLK2 edge, provided setup and hold (t23 and t24) requirements 
are met. This waveform is useful for determining Hold Acknowledge latency. 
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Figure 66. Requesting Hold from Active Bus (NA Asserted) 





Table 21. Component and Revision Identifier History 


Intel Am386DX/DXL 
i386 Microprocessor 


Stepping Name Revision 


Component Revision 
Identifier Identifier 
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amp @N 








Internal | 
| ——__—_-__— ee | Qh send . 
nee? f Initialization Cycle 1 
= 15 CLK2 duration if not | 
going to request self-test. Non-Pipelined | 
2 80 CLK2 duration before lf self-test is performed, add (Read) 
requesting self-test. (2?°) + 60* to these numbers TH T2 





TY 25.33 


17 18 |19 ||395 1396 397 |398 
cLk2 [ 
Reset [ 


[o2[o1lo2]/01]o2 
euecerera’ LX XX XXIKX XXX 


Negated to allow sensing of a 


* Approximately 







No self-test 387DX math coprocessor : 
we YVYYYVYVVYVV VVY ! 
susy [ XXXXXXXXKKH| ote 1 XXY | Il NXXXKX 

| Low to begin self-test (Note 2) | Asserted to indicate 387DX | 


$9 | | math coprocessor protocol 
a YYVYYVYYYVIY VY IYYYVYVYYYVYVYVYVYYVYVYV IVY Y¥ | VWYYVVYVY 
ERROR L XXXKX XX XXKX» KX /N KXXKXKKKKAKKMA KXXK | | KXXXKX 
See eee Up to 30 CLK2 
BES-BEO, W/R 
M/1O, HLDA [ XXXXXXKA| Low |] During Reset KXXXXAKXXXDOA KK _Valid 1 
Up to 30 CLK2 


wi tae: [ XXXXXXXY| Hohl During Reset XXXXXAXXXXKAKXK Vat 
Up to 30 CLK2 ia |e 
ADS [ XXX XXX XY High}} During Reset 
nA [ XXXXXXXXXXAKXXXXXXXXXXKXXXADRKKXRAPKRAKXKADRN 
pss [ XXXXXXXXXXHXXXXXKAXXXKKXXKAPKXXXDAPKADXKADLN 
READY [ XXXKXXXXXXXAKXXXKKAXXKKXXKKAKKKAKAKKKXKADKX 
pst-po [ XXXXXXX)---- |b ----- (reading peesseaesell sense oe eee sae 


Notes: 1. BUSY should be held stable for 8-CLK2 periods before and after the CLK2 period in which RESET falling edge occurs. 
2. If self-test is requested, the Am386DX/DXL microprocessor outputs remain in their reset state as shown here and in Table 14. 


” 











Figure 67. Bus Activity from Reset Until First Code Fetch 15021B-070 


CLK2 DL /\SN\S\SN\I NI NINN NI NI NI NI NIN NI NI NI NT NI NI NI 


Contel: (Eu Wald one ee Sa eee eee eee > ace 
Data, == Valid stint eceeonscemeeeains ne enee a? Cae 
pasross [XK Val von nee eens — 
Reset le - e 


15022B-029 
Figure 68. Entering and Exiting FLT 
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Self-Test Signature 

Upon completion of self-test, (if self-test was requested 
by holding BUSY Low atleast eight CLK2 periods before 
and after the falling edge of RESET), the EAX register 
will contain a signature of 00000000h indicating the 
Am386DX/DXL CPU passed its self-test of microcode 
and major PLA contents with no problems detected. The 
passing signature in EAX, 00000000h, applies to all 
Am386DX/DXL microprocessor revision levels. Any 
non-zero signature indicates the AmM386DX/DXL CPU 
unit is faulty. 





Component and Revision Identifiers 

To assist AmM386DX/DXL microprocessor users, the mi- 
croprocessor after reset holds a component identifier 
and a revision identifier in its DX register. The upper 8 
bits of DX hold 03h as identification of the Am3886DX/ 
DXL CPU component. The lower 8 bits of DX hold an 
8-bit unsigned binary number related to the component 
revision level. The revision identifier begins chronologi- 
Cally with a value zero and is subject to change (typically 
it will be incremented) with component steppings in- 
tended to have certain improvements or distinctions 
from previous steppings. 


These features are intended to assist Am386DX/DXL 
microprocessor users to a practical extent. However, 
the revision identifier value is not guaranteed to change 
with every stepping revision nor to follow a completely 
uniform numerical sequence, depending on the type or 
intention of revision or manufacturing materials required 
to be changed. 


Coprocessor Interfacing 

The Am386DX/DXL microprocessor provides an auto- 
matic interface for a 387DX floating-point math co- 
processor. A 387/DX math coprocessor uses an |/O- 
mapped interface driven automatically by the 
Am386DX/DXL microprocessor and assisted by three 
dedicated signals: BUSY, ERROR, and PEREQ. 


As the Am3886DX/DXL CPU begins supporting a 
coprocessor instruction, it tests the BUSY and ERROR 
signals to determine if the coprocessor can accept its 
next instruction. Thus, the BUSY and ERROR inputs 
eliminate the need for any preamble bus cycles for com- 
munication between processor and coprocessor. A 
387DX math coprocessor can be given its command 
op-code immediately. The dedicated signals provide 
instruction synchronization, and eliminate the need of 
using the Am386DX/DXL CPU WAIT op-code (9Bh) for 
387DX math coprocessor instruction synchronization 
(the WAIT op-code was required when 8086 or 8088 
was used with the 8087 coprocessor). 














Custom coprocessors can be included in Am386DX/ 
DXL microprocessor based systems, via memory- 
mapped or |/O-mapped interfaces. Such coprocessor 
interfaces allow a completely custom protocol, and are 
not limited to a set of coprocessor protocol primitives. In- 
stead, memory-mapped or I/O-mapped interfaces may 
use all applicable Am386DX/DXL microprocessor in- 
structions for high-speed coprocessor communication. 
The BUSY and ERROR inputs of the Am386DX/DXL 
CPU may also be used for the custom coprocessor in- 
terface, if such hardware assist is desired. These sig- 
nals can be tested by the AmM386DX/DXL CPU WAIT op- 
code (9Bh). The WAIT instruction will wait until the 
BUSY input is negated (interruptable by an NMI or en- 
able INTR input), but generates an Exception 16 fault if 
the ERROR pin is in the asserted state when the BUSY 
goes (or is) negated. If the custom coprocessor inter- 
face is memory-mapped, protection of the addresses 
used for the interface can be provided with the 
Am386DX/DXL microprocessor on-chip paging or seg- 
mentation mechanisms. If the custom interface is |/O- 
mapped, protection of the interface canbe provided with 
the Am386DX/DXL microprocessor IOPL (I/O Privilege 
Level) mechanism. 


A 387DX math coprocessor interface is I/O mapped as 
shown in Table 22. Note that a 387DX math coproces- 
sor interface addresses are beyond the OhFFFFh range 
for programmed I/O. When the Am386DX/DXL CPU 
supports a 387DX math coprocessor, the Am386DX/ 
DXL microprocessor automatically generates bus cy- 
cles to the coprocessor interface addresses. 














Table 22. Math Coprocessor Port Addresses 
Address in Am386DX/DXL 387DX 
| CPU I/O Space Coprocessor Register 
Opcode Register 
800000F8h (32-bit port) 





Operand Register 


800000FCh (32-bit port) 





To correctly map a 387DX math coprocessor registers 
to the appropriate I/O addresses, connect a 387DX 
math coprocessor CMDO0 pin directly to the A2 output of 
the Am386DX/DXL microprocessor. 


Software Testing for Coprocessor Presence 


When software is used to test for coprocessor (387DX) 
presence, it should use only the following coprocessor 
op-codes: FINIT, FNINIT, FSTCW mem, FSTSW mem, 
FSTSW AX. To use other coprocessor op-codes whena 
coprocessor is known to be not present, first set EM = 1 
in Am386DX/DXL microprocessor CRO. 
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ABSOLUTE MAXIMUM RATINGS 


Storage Temperature ........... —65°C to +150°C 
Ambient Temperature Under Bias . . —65°C to +125°C 
Supply Voltage with Respect 

(0 A ee oe a a —-0.5Vto+7V 
Voltage on Other Pins ........ —0.5 V to Vcc +0.5 V 
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Stresses above those listed under ABSOLUTE MAXIMUM 
RATINGS may cause permanent device failure. Functionality 
at or above these limits is not implied. Exposure to Absolute 
Maximum Ratings for extended periods may affect device 
reliability. 


DC CHARACTERISTICS over COMMERCIAL operating ranges 


Vec=5 V +5%; Tease = 0°C to +85°C (PGA) 


Vec=5 V+10%; Tcase = 0°C to +100°C (PQFP —20, 25, and 33 MHz) 
Vec=5 V+5%; Tcase = 0°C to +100°C (PQFP —40 MHz) 


input High Voltage ae 


Parameter Description 


CLK2 Input Low Voitage 
| CLK2 Input High Voltage 


Output Low Voltage 
lo. =4 mA: A31—A2, D31—D0 


lo. =5 mA: BE3—BEO, W/R, 
D/C, M/iO, LOCK, ADS, HLDA 


Output High Voltage 
low= 1 MA: A31—A2, D31—DO 


lou = 0.9 mA: BES-BEO, 
W/R, D/C, M/IO, LOCK, 


Input Low Voltage (Note 1) 


Input Leakage Current 
(All pins except BS16, PEREQ, 
BUSY, FLT, and ERROR) 


Input Leakage Current 
(PEREQ Pin) 


Input Leakage Current 
(BS16, BUSY, FLT, and ERROR) 
Supply Current 

CLK2 = 40 MHz: with —20 

CLK2 =50 MHz: with -25 


CLK2=66 MHz: with —33 
CLK2 = 80 MHz: with —40 


. The Min value, —0.3, is not 100% tested. 
. PEREQ input has an internal pulldown resistor. 








Not 100% tested. 


. Inputs at rails (Vcc or Vss). 
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Vin=2.4V 
(Note 2) 


L= 0.45 
(Note 3) 


(Note 7) Vcc = 5.0 V 
Ice Typ = 130 
Ice Typ = 160 
lec Typ =210 
lce Typ = 330 


Standby Current lecss Typ = 20 WA 
(Am386DXL microprocessor) | (Note 5) 

Input or I/O Capacitance Fo=1 MHz (Note 4) 
Output Capacitance Fo=1 MHz (Note 4 


CLK2 Capacitance Fo=1 MHz (Note 4) 





) 


| 
oO 
w 


ho 
oO 


NO 
NJ 


Vec = 5.5 V 
155 
190 
245 


2.4 
2.4 


. BS16, BUSY, FLT, and ERROR inputs each have an internal pullup resistor. 





. Measurement taken with inputs at rails, outputs unloaded, BS16, BUSY, FLT, and ERROR at Vec voltage level, PEREQ at Gnd. 
. Outputs are CMOS and will pull to rail if load is not resistive. 
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SWITCHING CHARACTERISTICS over COMMERCIAL operating range — 40 MHz 
Vec=5 V +5%; Tcase = 0°C to +85°C (PGA) | 
= =5 V +5%; Tcase = 0°C to +100°C (PQFP) 


| No. | Parameter Description [Ret Figure ace 
Oper. Frequency: Am386DX CPU Half CLK2 freq. 40 MHz 
Am386DXL CPU Half CLK2 freq. 40 ra 

[2 | CLK2 High Time e—_—_+ 2 1 te 


CLK2 Period: | Am386DX CPU 71 12.5 
Am386DXL CPU 71 12.5 
[3__| CLK2 Low Time patosv | tt ts 


4 _[oteeraltine ——~dwiavvoaviwesy) | m | | id ne 
rs [oka riseTime +d oav-27viwotes) | 1 | + 4 | ns 
[é[Ast-A2Vaid Delay ————~dt Ginsopr | ora | «| 1a ns 
7 | ASt-A2 Float Delay id Nolet) SS Std 2 
a | BeS-BED, LOCK Valid bey | G.nsopF + varaei | 4 | 13 | ne | 
fo [ses-ne,coox rea beiy [oee) OT st_[ ee Eo | 
som | mi Vatd Doty Gace ora | | 
ri we 0 AER we) hfe 
[12 _[ Det=Do Wite Data Vaid Delay | C.=50pF Note) | Taras | 7 | 18 [ns 
Tea | 031-DOWite DataHo Tine | Gesopr | 7a7e | 2 | | rs 
cE 
Cakseuptine 
Co aa 
So 

























re 
AINMOETNT ATS 


NO PERO TNO END TN EN EN Fm PSs Pas Pea Pe po be 
PILWIN [=H [O lO [OINIO Pasar 









|BsiéSetupTime | ——s—C—idCY 
BS16 Hold Time 





READY SS Time 


ae 
2 
| 
2 
es 
2 
[osi-D0 Read SeupTime —~[ SSS 
[081-D0 Read Holme ——~+d| Cid 
[HOLD Seuptme ———SOSC~iSC(CSSSCSCS~‘idSCSCi 
CHOLD Hold Time re 
[RESET Setup Tine —SC~SC(C‘“‘<;<S;*S*‘~rdtCt 
s_[reseroa tine Pe 
7 [ron we soup Tine | ee) 72 
CNM INTR Hold Tine | (Wot) Sid Se 


PEREQ, ERROR, BUSY, no 2) 72 | 
FLT* Setup Time 

PEREQ, ERROR, BUSY, (Note 2) 72 

FLT* Hold Time 


Notes: 1. Float condition occurs when maximum output current becomes less than Ito in magnitude. Float delay is not 100% tested. 
2. These inputs are allowed to be asynchronous to CLK2. The setup and hold specifications are given for testing purposes, to assure 
recognition within a specific clock period. 
3. Rise and fall times are not tested. 
4. Min time not 100% tested. 
*PQFP package only. 


©) | O1 
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[26 | NM, INTR Hold Time 
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SWITCHING CHARACTERISTICS over COMMERCIAL operating range — 33 MHz 
Vec=5 V +5%; Tcase = 0°C to +85°C (PGA) 
= =5 V +10%; Tcase = 0°C to +100°C (PQFP) 


[Parameter Description | Notes | Ret Figure | min | Max _|_unt 
Yeeros [mess [| Lae ae 

Am386DXL CPU Half CLK2 freq 33. 3 MHz 
wm eee |e oe = Te 

Am386DXL CPU 71 15 
[2 | cuk2HighTime atc ts _ 
}3 | ciketowTime ft ators et OT ds 
[4 | cikeralitime | 7 v-0.8viNotes) | 71 | ns 
[5 | CLK2RiseTime | 8 V2.7 V (Notes) | 71 | ns 
fs | Ast-Az Vaid Delay «dt esopr | 7aer | 4 | 16 | ne | 
[7 | A3I-A2FloatDelay | (Note t) | 8s 
|8__| BES-BEO,LOCK Valid Delay | Ci=S0pF_ | 70,73,81 | 4 | 5 ns 
To | BES-BES,COCK Float Delay | Note) +t set —S«d| «dod 
[10_| WR, MMO, D/C Valid Delay | Ci=50pF_ | 70,7381 | 4 | 15 ns 
[10a | ADSvalidDelay | u=50pF | 70,73,81 | 4 | 145 | ns 
Tit_[ Wi, MM6, DIG, ADS FioatDelay | Woes) «| sat —sd| «dT 20d 
[12 | 031-DoWrte Data Valid Delay | C.-S0pF (Notes) | 70,7461 | 7 | 23 | ns_ 
[12a | D31-DOWriteDataHold Time | Gi=50pF_ | 70,75 | 2s 
ia [ D91-D0Float Delay «i Note) ~——SOSSC~C~iSCiTSC*dSSC dS 
[14 | HLDAValid Delay | Cu50pF_ | 70,81 | 4 20s 
[141 | HLDA Float Delay (POFP Only) | (Notet) | 7a8t | 4 | 20 | _ 
(15 | NASetupTime 0 ts 
[16 | NAHoldTime ts 
[17 | BsieSetupTime is 
}ig | BSiéHoldTime | s_ 
[19 | READY SetupTime | Te is_ | 
[20 | READYHoldTime | is 
|21__| D3t-DoReadSetupTime | ts 
[22 | Dai-DoReadHoldTime | | 7 is 
}23 | HOLDSeupTime | ts 
[24 | HOLDHoldTime es 
[25 | RESETSeupTime | eis 
ST 
ee 
















































29 PEREQ, ERROR, BUSY, a 2) 
FLT* Setup Time 

30 | PEREQ, ERROR, BUSY, (Note 2) 
FLT* Hold Time 


Notes: 1. Float condition occurs when maximum output current becomes less than Ito in magnitude. Float delay is not 100% tested. 
2. These inputs are allowed to be asynchronous to CLK2. The setup and hold specifications are given for testing purposes, to assure 
recognition within a specific clock period. 
3. Rise and fall times are not tested. 
4. Min time not 100% tested. 
*PQFP package only. 
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SWITCHING CHARACTERISTICS over COMMERCIAL operating range — 25 MHz 
Vec=5 V +5%; Tcase = 0°C to +85°C (PGA) . 
Vec=5 V +10%; Tease = 0°C to +100°C (PQFP) | 


[No. | Parameter Description | Notes | Ref Figure| Min | Max | Unit 
ee 
Am386DXL CPU Half CLK2 freq. 0 25 MHz 
on ———s- S 2 
Am386DXL CPU 71 20 
}2_ | CLK2HighTime fate S| ts 
(3 | CLK2LowTime ss Cf ators CE tC CTs 
[4 | clkaFalltime | 7 V-OBV(Notes) | 71 | S| 7 ins _| 
[5 | CLK2RiseTime | OB V-RTV(Notes) | 71 | | 7 sins 
}6 | ASt-A2Valid Delay | CuSOpF_ | 70,73,81 | 4 | 17s 
[7 | AS1-A2FloatDelay is (Note 1) = | St] 4 80s 
| BE3-BEO, LOCK Float Delay j(Notet) | tS AT 80s 
(RMA, D/C, ADS Valid Delay | G.=50pF_ | 70,7381 | 4 | 17s 
/RMAO, DIC, ADS Float Delay | (Note1) ss] St | 4] 80s 
D31-DO Write Data Valid Delay | Ci=50pF_ | 70,7481 | 7 | S28 |ons 
12a_|_D31-Do Write Data Hold Time PC.=50pFo | 7,75 | 2s 
31—D0 Float Delay P(Notet) Tt ns 
LDA Valid Delay PC.=50pFo | 7,81 | Tn 
LDA Float Delay (PQFP Only) | (Note1) ~~ dL S77,81 | 4 | 80s 


NA Setup Time 
NA Hold Time 


BS16 Setup Time 
BS16 Hold Time 
READY Setup Time 
READY Hold Time 
31—D0O Read Setup Time 


31—D0 Read Hold Time 


OLD Setup Time a 





















w 
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| 


afew fu 
Mt | O 





rs 


—_ J A —_ fF i fF ok J 
co |N ajaAlaAlo 


aL 


N NN 
; ’ 


+ 
NO 


72 
| 72 
7 


2 
82 
82 


+ 


— 
© 





ie 


O 





xr 


OLD Hold Time 
RESET Setup Time 
RESET Hold Time 


NMI, INTR Setup Time | (Note 2) ae ee er ae ee 
NMI, INTR Hold Time (Note 2) 


29 PEREQ, ERROR, BUSY, FLT* (Note 2) 72 
Setup Time 
30 PEREQ, ERROR, BUSY, FLT* (Note 2) 72 
Hold Time | 


Notes: 1. Float condition occurs when maximum output current becomes less than Ito in magnitude. Float delay is not 100% tested. 
2. These inputs are allowed to be asynchronous to CLK2. The setup and hold specifications are given for testing purposes, to assure 
recognition within a specific clock period. 
3. Rise and fall times are not tested. 
*PQEP package only. 
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SWITCHING CHARACTERISTICS over COMMERCIAL operating range— 20 MHz 
Vec=5 V +5%; Tcase = 0°C to +85°C (PGA) 
Voc =5 V +10%; Tcase = 0°C to +100°C (PQFP) 


No. | ParameterDescription | Notes | Ref Figure| Min | Max | Unit 
[fowmenw sommes [meme | Te Ls [as 
Am386DXL CPU Half CLK2 freq MHz 
ae ae 
Am386DXL CPU 71 
2 [oukenightime Sd es 
ee eo SV a 
[fé[otkerantime +i a7v-oaviores) | 71 | +e 
rs OLK2 Rise Tine —————~*dY os ear v Nota) | | + 8d 
[é[Ast-Aa Vaid Dey | Gan t20eF | 7073. | 4 [| 30 | ns 
[7 ASt=A2 Fiat Doay +d Wore) Sid Si de 
[e | BES-BEO, LOCK Vals Delay | G.=75erF ‘| 7oraei | 4 [90 | re 
[a | BESBES, LOCK Fiat Delay | Wott) +4 +f +* | 2 | ns 
[10 WiR, Mi, DIG, ADS Vaid Delay | G.=7opF | Tora | 4 | 28 | re 
it | WIR, MIG, BIG, ADS Fost Delay | (Noe) ‘|__| 4] 30 | re 
[12_| Dst-DoWite Data Vaid Delay | C.nt20eF | 7o7aei | 4 | 98 | re 
[is_[Dst-DoFboatDoey if Net) SC*dSC 
ia [AUDA Vaid Dey | Geer | oer | 6 | 28 | ra 
[iat [ HUDA Float Delay POFP On) | Wetet) ——*+| vast | 4 | 30 | rs 
ris | nASeuptime SC | did 
A 0 
7 [esieseuptime Sid SSCS re i id 
rie [esienotime + SSSSSSCid i id 
[ie READY SoupTime _——~+| SCS ri id 
[20 READY Hold Time Sid SSSSCS~d re i id 
[21 | Dat-Do Read Setup Time | ———S—~i re i a id 
[22 _[Dat-Do Read Hod time ‘| Se Sid 
[23 [HOLD SeupTime Sd SSCS i i id 
a a 
[2s RESETSeupTime ——s«d| SSCS Si i 
fs [ reser peste 
aC a TT aa: 


PEREQ, ERROR, BUS (Note 2) 
Setup Time 

PEREQ, ERROR, BUSY, (Note 2) 
Hold Time 


Notes: 1. Float condition occurs when maximum output current becomes less than Ito in magnitude. Float delay is not 100% tested. 
2. These inputs are allowed to be asynchronous to CLK2. The setup and hold specifications are given for testing purposes, to assure 
recognition within a specific clock period. 
3. Rise and fall times are not tested. 
*PQFP package only. 
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SWITCHING WAVEFORMS 


The switching characteristics consist of output delays, 
input setup requirements, and input hold requirements. 
All characteristics are relative to the CLK2 rising edge 
crossing the 2.0 V level. 


Switching characteristic measurement is defined by 
Figure 69. Inputs must be driven to the voltage levels in- 
dicated by this diagram. Am386DX/DXL CPU output de- 
lays are specified with minimum and maximum limits 
measured as shown. The minimum Am386DX/DXL 
microprocessor delay times are hold times provided to 
external circuitry. Am3886DX/DXL microprocessor input 
setup and hold time are specified as minimums, defining 


\<—_____()_____» 
A31—A2, ADS, D/C, Valid 5 
COCK, MO, WR, | Output 1-5 V7 
BES-BEO, HLDA ihe 
D31—Do I 
_ 3.0V so 
NA, BST6, ‘s 
INTR, NMI IN 
OovV= we 





FLT, ERROR, 
BUSY, PEREQ, 


READY, HOLD, L 
D31—D0 


Legend: A—Maximum Output Delay Spec 
B—Minimum Output Delay Spec 


C—Minimum Input Setup Spec 
D—Minimum Input Hold Spec 





Note: Input waveforms have tr < 2.0 ns from 0.8 V to 2.0 V. 


the smallest acceptable sampling window. Within the 
sampling window, a synchronous input signal must 
be stable for correct Am386DX/DXL microprocessor 
operation. 


Outputs ADS, W/R, D/C, M/IO, LOCK, BE3—BEO, 
A31-—A2, and HLDA only change at the beginning of 
phase one. D31—D0 (write cycles) only change at the 
beginning of phase two. The READY, HOLD, BUSY, 
ERROR, PEREQ, FLT, and D31—D0 (read cycles) in- 
puts are sampled at the beginning of phase one. The 
NA, BS16, INTR, and NMI inputs are sampled at the 
beginning of phase two. 

















TX 
| . 
- FO - — -—\— -— - fF av 
Valid 
aN OV Output n+1 
Valid 4 5 Wats “ly Valid 
ye a Hi 





Valid 
. 1.5V Input !-> V fst 


0 V 2 SS 


1§021B—071 


Figure 69. Drive Levels and Measurement Points 
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CL 


Cx includes all parasitic capacitances. 


Figure 70. AC Test Load 


t1 


t2 
Vec—0.8 V —— \ —————s 7 a 
~CLK2 2.0 V = —=— 
0.8 V —_— beeen 
t5 t3 t4 


Figure 71. CLK2 Timing 
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HOLD 


INTR, NMI 


CLK2 


A31-—A2 


HLDA 
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15021B-074 
Figure 72. Input Setup and Hold Timing 


‘ 2 o1 


62 1 
A \ 
[Tain 


Valid n 


ial Max 


{Valid n+1 


En ae ee 


y 
Valid n x: Valid n+1 
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6 
8 TE Tin Max 


Valid nat 





15021B-075 
Figure 73. Output Valid Delay Timing | 
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T1 
o1 | 2 
CLK2 I 
wa 
12 Min Ma 
D31-Do i Valid n 
| 15021B-076 
Figure 74. Write Data Valid Delay Timing (25, 33, and 40 MHz) 
T1 
o1 2 
CLK2 [ 
wa [ 
: Min 
ti2a 
D31-Do [ Valid n J iii, 
15021B-077 
Figure 75. Write Data Hold Timing (25, 33, 40 MHz) 
T1 
o1 2 
CLK2 [ 
wa 
12 Min Max 
| 15021B—078 
Figure 76. Write Data Valid Delay Timing (20 MHz) 
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nom + 6 


nom +3 


nom 
Output Valid Delay (ns) 


nom —3 | 


nom —6 





Ci (picofarads) 


Note: This graph will not be linear outside of the C. range shown. 15021B-—079 


Figure 77. Typical Output Valid Delay Versus Load Capacitance 
at Maximum Operating Temperature (C_=120 pF) 


nom +9 
nom +6 
nom+3 
Output Valid Delay (ns) 
nom 
. nom —3 
nom —6 
75 100 125 150 


Ci (picofarads) 
Note: This graph will not be linear outside of the C. range shown. 15021B—080 


Figure 78. Typical Output Valid Delay Versus Load Capacitance 
at Maximum Operating Temperature (C.=75 pF) 
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nom +9 


nom +6 


Output Valid Delay (ns) 
nom +3 
nom 


nom —3 


50 75 100 125 150 
Ci (picofarads) 


Note: This graph will not be linear outside of the C. range shown. 





15021B-081 
Figure 79. Typical Output Valid Delay Versus Load Capacitance 
at Maximum Operating Temperature (C= 50 pF) 
8 
6 
Rise Time (ns) 0.8 V—2.0 V 4 
2 
8 
50 75 100 125 150 
Ci (picofarads) 
Note: This graph will not be linear outside of the C. range shown. 15021B-082 


Figure 80. Typical Output Rise Time Versus Load Capacitance 
at Maximum Operating Temperature 
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| Th | Tior T1 
o2 | o1 | 02 | 61 | 62 
x | A= A= 
t9 
a | | Min | [Min |_| Max 
"a Wied ome oo 
LOCK 
t11 be t10 t10a 
: | | Min | | Max ‘Min |_| Max 
"og.abs | LSet ete ee 
t7 t6 
| | Min | | Max [Min |__| Max 
isi [ rE-Hos4—-s 
| (High Z) 
t13 t12 
| | Min | | Max [Min | Max 
car [ CE =F m= — 
| (High Z) 
t13—Also applies to data float when write 
cycle is followed by read or idle 
t14 t14f t14 t14f 
Max || Min | Max 
HDA [ : | ke ; 


Figure 81. Output Float Delay and HLDA Valid Delay Timing 


Initialization Sequence 






o2oro1 62 o 1 





The second internal processor phase following RESET High-to-Low transition (provided t25 and t26 are met) is 62. 


Figure 82. RESET Setup and Hold Timing and Internal Phase 
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INSTRUCTION SET 


This section describes the Am386DX/DXL micropro- 
cessor instruction set. A table lists all instructions along 
with instruction encoding diagrams and clock counts. 
Further details of the instruction encoding are then pro- 
vided in the following sections, which completely de- 
scribe the encoding structure and the definition of all 
fields occurring within Am386DX/DXL CPU instructions. 


Am386DX/DXL Microprocessor instruc- 
tion Encoding and Clock Count Summary 
To calculate elapsed time for an instruction, multiply the 
instruction clock count, as listed in Table 23, by 
the processor clock period (e.g., 50 ns for a 20-MHz, 
40 ns for a 25-MHz, 30 ns for a 33-MHz, and 25 ns fora 
40-MHz Am386DX/DXL microprocessor). 


For more detailed information on the encodings of 
instructions refer to Section Instruction Encodings. Sec- 
tion Instruction Encodings explains the general struc- 
ture of instruction encodings and defines exactly the 
encodings of all fields contained within the instruction. 


instruction Clock Count Assumptions 


1. The instruction has been prefetched and decoded, 
and is ready for execution. 


AMD cl 


2. Bus cycles do not require wait states. 


3. There are no local bus HOLD requests delaying 
processor access to the bus. 


4. No Exceptions are detected during instruction 
execution. 


5. If an effective address is calculated, it does not use 
two general register components. One register, 
scaling, and displacement can be used within the 
clock counts shown. However, if the effective 
address calculation uses two general register 
components, add 1 clock to the clock count shown. 


Instruction Clock Count Notation 


1. If two clock counts are given, the smaller refers to a 
register operand and the larger refers to a memory 
operand. 


2. n=number of times repeated. 


3. m = number of components in the next instruction 
executed, where the entire displacement (if any) 
counts as one component; the entire immediate data 
(if any) counts as one component; and each of the 
other bytes of the instruction and prefix(es) each 
count as one component. 
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Table 23. Am386DX/DXL Microprocessor Instruction Set Summary 
|__Clock Count_| Comments _| 





Protected 
Real Virtual | 
| Address 
[Instruction Format | Mode 
| GENERAL DATA TRANSFER 
| MOV= Move: 


Register to Register/Memory 






L1o00100w |modreg _1m_| 
ooo101w |modreg_m_| 
Hrorooo1w | full displacement 


10001110 mod sreg3 r/m 
MOVSX = Move with Sign Extension 


Register from Register/Memory 100001111 1011111w |modreg rim | 


MOVZX = Move with Zero Extension 


Register from Register/Memory 00001111 1011011Ww | mod reg rim | 


PUSH = Push: 
powers asain 


[ieoarsrs [noseoe om] 
feaaweae 11 
Clock Count 


Virtual 


IN =Input from: 8086 Mode 


Fixed Port 1110010W = | port number 026 
Variable Port 027 


OUT = Output to: 


Fixed Port port number 024 
Variable Port 025 
LEA = Load EA to Register modreg  r/m 


Register/Memory to Register 






Immediate to Register/Memory immediate data 


Immediate to Register (short form) immediate data 











Memory to Accumulator (short form) full displacement 





Accumulator to Memory (short form) 
Register/Memory to Segment Register 


Segment Register to Register/Memory 





Register/Memory 






Register (short form) 








Segment Register (ES,CS,SS, or DS) 
| Segment Register (FS or GS) 
| Immediate immediate data 


PUSHA = Push All 





POP =Pop 


| Register/Memory 






| Register (short form) 











| Segment Register (ES, SS, or DS) 
Segment Register (FS or GS) 
POPA=PopAll 








XCHG = Exchange 
Register/Memory with Register 


Register with Accumulator (short form) 








6*/26** 


7*/27** 


| 4*/24** 


5/25" 


*IfCPL<SIOPL ** If CPL>lOPL 


& Clock count shown applies if /O permission allows 1/O to the port in Virtual 8086 Mode. If /O bit map denies permission, Exception 13 fault occurs; refer to clock counts for INT 3 
instruction. 
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Table 23. Am386DX/DXL Microprocessor Instruction Set Summary (continued) 
|_Clock Count _| Comments _ | 






Real Real 
Address Address] Address 
Instruction Format Mode Mode 


SEGMENT CONTROL 


LDS =Load pointer to DS 11000101 
LES =Load pointer to ES 11000100 
LFS=Load pointer to FS 00001111 
LGS = Load pointer to GS 00001111 
LSS =Load pointer to SS 00001111 


FLAG CONTROL 


CLC =Clear Carry Flag 11111000 


CLD = Clear Direction Flag 11111100 
CLI = Clear Interrupt Enable Flag 11111010 
CLTS=Clear Task Switched Flag 00001111 
CMC = Complement Carry Flag 11110101 
LAHF = Load AH into Flag 10011111 
POPF = Pop Flag 10011101 
PUSHF = Push Flag 10011100 
SAHF = Store AH into Flag 10011110 
STC = Set Carry Flag 11111001 


STD =Set Direction Flag 11111101 


o mo no OF f+ oO MD ND DOD WD YM NM 


STI = Set Interrupt Enable Flag 11111011 | 
ARITHMETIC 
ADD=Add 


Register to Register 000000dw 

Register to Memory 0000000Ww 

Memory to Register 

Immediate to Register/Memory | immediate data 
Immediate to Accumulator (short form) immediate data 

ADC = Add with carry 

Register to Register 

Register to Memory 

Memory to Register 
Immediate to Register/Memory immediate data 





Immediate to Accumulator (short form) | 0001010Ww immediate data 


INC =Increment 

Register/Memory 
Register (short form) 01000 reg 

SUB =Subtract 


Register from Register 001010dw 
Register from Memory 0010100Ww | mod reg rim | 
Memory from Register 0010101w 
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Table 23. Am386DX/DXL Microprocessor Instruction Set Summary (continued) 


Clock Count_| Comments _| 


Instruction 





ARITHMETIC (continued) 


Immediate from Register/Memory 0010011Ww mod101 t/m | immediate data 
Immediate from Accumulator 0001110w immediate data 


(short form) 


SBB = Subtract with Borrow 


Register from Register 000110dw 
Register from Memory 0001100w 
Memory from Register 0001101w 


Immediate from Register/Memory 100000sw mod011 r/m | immediate data 
Immediate from Accumulator 0001110w immediate data 


DEC = Decrement 


Register/Memory 11111141w regO001 r/m 


Register (short form) 01001 reg 


CMP = Compare 


Register with Register 
| Memory with Register 0011100w laediae: dene 
| Register with Memory Gea Waodiwe | Limodreas ial 
| Immediate with Register/Memory | 100000sw | modi41 1m immediate data 


Immediate with Accumulator(short form} 0011110W immediate data 


NEG = Change Sign 
AAA=ASCIl Adjust for Add 00110111 


DAA = Decimal Adjust for Add 001111114 


AAS = ASCIll Adjust for Subtract 00100111 
DAS = Decimal Adjust for Subtract | 00101111 


MUL = Multiply (Unsigned) 


Accumulator with Register/Memory 1111011w | mod100 = tm 


Multiplier -Byte 12-17/15-20] 12-17/15-20 
-Word 12-25/15-28 | 12-25/15-28 
-Doubleword 12-41/15-A4]12-41/15-44 

| IMUL = Integer Multiply (signed) 


Accumulator with Register/Memory 1111011Ww mod101 = ¢t/m 


Multiplier -Byte 12-17/15-20]12-17/15-20 
-Word 12-25/15-28 | 12-25/15-28 
-Doubleword 


12-41/15-44 ]12-41/15-44 
Register with Register/Memory 00001111 10101111 


Multiplier -Byte 12-17/15-20 
-Word 12-25/15-28 
-Doubleword 12-41/15-44 

Register/Memory with Immediate 

to Register 01101081 modreg  r/m immediate data 


-Word |13-26/14-27 | 
-Doubleword |13-42/14-43 
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Table 23. Am386DX/DXL Microprocessor Instruction Set Summary (continued) 
|_Clock Count_| Comments _| 


Address| Address 


Instruction 
ARITHMETIC (continued) 
DIV = Divide (Unsigned) 


Accumulator by Register/Memory 
Divisor -Byte 
-Word 
-Doubleword 
| IDIV = Integer Divide (Signed) 
Accumulator by Register/Memory 
Divisor -Byte 
-Word 
-Doubleword 
AAD =ASCli Adjust for Divide 


AAM =ASCIll Adjust for Multiply 
CBW =Convert Byte to Word 


CWD =Convert Word to 
Double Word 


LOGIC 
Shift/Rotate Instructions 


Format 





1111011WwW mod110 = ft/m 


11110112 | mod111 1m | 


Not Through Carry (ROL, ROR, SAL, SAR, SHL, and SHR) 


Register/Memory by 1 
Register/Memory by CL 


Register Memory by Immediate Count 


Through Carry (RCL and RCR) 
Register/Memory by 1 
Register/Memory by CL 


Register/Memory by Immediate Count 


SHLD = Shift Left Double 
Register/Memory by Immediate 
Register/Memory by CL 
SHAD = Shift Right Double 
Register/Memory by Immediate 
Register/Memory by CL 

AND =And 

Register to Register 

Register to Memory 

Memory to Register 


Immediate to Register/Memory 


Immediate to Accumulator (short form) 


Register/Memory and Register 


Immediate Data and Register/Memory 


immediate Data and Accumulator 


11101001Ww mod TTT = r/m 
1100000W mod TTT t/m immediate 8-bit data 


immediate 8-bit data 
TTT 


Instruction 
ROL 
ROR 
RCL 
RCR 

SHLUSAL 
SHR 
SAR 


00001111 10100100 | modreg rim |immediate 8-bit data 
00001111 10100101 


00001111 10101100 | modreg rim immediate &-bit data 
00001111 10101101 


1000000W mod110 r/m immediate data 
0010010W immediate data 


TEST = And Function to Flags, no Result 


1111011Ww mod000 tm | immediate data 
1010100W immediate data 
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Table 23. Am386DX/DXL Microprocessor Instruction Set Summary (continued) 















Format 

LOGIC (continued) 

OR=Or 

Register to Register 2 2 

Register to Memory 7 7 
‘| Memory to Register 6 6 

Immediate and Register/Memory immediate data 2/7 2/7 

Immediate to Accumulator (short form) immediate data 2 2 

XOR = Exclusive or 

Register to Register 2 2 

Register to Memory 7 7 

Memory to Register 6 6 

Immediate to Register/Memory immediate data 2/7 2/7 

Immediate to Accumulator (short form) immediate data 2 2 


NOT =Invert Register/Memory 


1111011Ww mod 0 1 Or/m 2/6 2/6 


STRING MANIPULATION Clock Count 
Virtual 8086 
CMPS = Compare Byte/Word 1010011Ww Mode 10 10 


INS = Input Byte/Wd from DX Port 9*/29** 


0110110W 


LODS = Load Byte/Wd to AL/AX 1010110wW 5 5 


MOVS = Move Byte/Word 1010010w 8 8 


OUTS = Output Byte/Wd to DX Port | 0110111W 14 8*/28** 


—_ 
4] 


SCAS = Scan Byte/Word 1010111Ww 8 8 


STOS = Store Byte/Word from AL/AX/EX}| 1010101W 5 5 





XLAT = Translate String 11010111 5 5 


REPEATED STRING MANIPULATION Repeated by Count in CX or ECX 
REPE CMPS = Compare string 


(Find Non-Match) 11110011 1010011Ww Clock Count 5+9n 5+9n 
REPNE CMPS =Compare String Virtual 8086 
(Find Match) 11110010 |1010011w Mode 54+9n 5+9n 
REP INS = Input String 11110010 0110110W 028 +6n 14+6n 8+6n*/ 
28 +6n** 
REP LODS = Load String 11110010 1010110w 5+6n 5+6n 
REP MOVS= Move String 11110010 1010010w 8+4n 8+4n 
REP OUTS = Output String 11110010 0110111Ww 026 + 5n 12+5n | 6+5n/ 
26 + 5n** 





REPE SCAS =Sean String 
(Find Non-AL/AX/EAX) 
REPNE SCAS =Store String 
(Find AL/AX/EAX) 


11110011 10710111W 5+8n 5+8n 


11110010 1010111W 
11110010 1010101WwW 


00001111 | 10111100 1143n | 1143n 
00001111 | 10111101 9+3n | 94+3n 


** If CPL > IOPL 






5+8n 5+9n 
REP STOS =Store String 


BIT MANIPULATION 
BSF = Scan Bit Forward 


5+5n 5+5n 





BSR=Scan Bit Reverse 





* If CPLSIOPL 


© Clock count shown applies if /O permission allows I/O to the port in Virtual 8086 Mode. If I/O bit map denies 
permission, Exception 13 fault occurs; refer to clock counts for INT 3 instruction. 
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Table 23. Am386DX/DXL Microprocessor Instruction Set Summary (continued) 





Format 


BIT MANIPULATION (continued) 
BT = Test Bit 


Register/Memory, Immediate 00001111 10111010 mod10 0 1r/m|immediate 8-bit data 
Register/Memory, Register 00001111 10100011 


BTC = Test Bit and Complement 


Register/Memory, Immediate 00001111 10111010 mod111 f/m |immediate 8-bit data 
Register/Memory, Register 00001111 10111011 


BTR =Test Bit and Reset 


Register/Memory, Immediate 00001111 10111010 mod110 r/m |immediate 8-bit data 
Register/Memory, Register 00001111 10110011 


BTS = Test Bit and Set 


Register/Memory, Immediate 00001111 10111010 mod101 f/m |immediate 8-bit data 
Register/Memory, Register 00001111 10101011 


CONTROL TRANSFER 
CALL = Call 


Direct Within Segment 11101000 full displacement 
Register/Memory 11111117 mod010 = t/m 


Indirect Within Segment 


Direct Intersegment 10011010 unsigned full offset, selector 


Protected Mode Only (Direct Intersegment) 


Via Call Gate to Same Privilege Level 

Via Call Gate to Different Privilege Level, (No Parameters) 

Via Call Gate to Different Privilege Level, (x Parameters) 

From 80286 Task to 80286 TSS 

From 80286 Task to Am386DX/DXL CPU TSS 

From 80286 Task to Virtual 8086 Task (Am386DX/DXL CPU TSS) 

From Am386DX/DXL CPU Task to 80286 TSS 

From Am386DX/DXL CPU Task to AmM386DX/DXL CPU TSS 

From Am386DX/DXL CPU Task to Virtual 8086 Task (Am386DX/DXL CPU TSS) 


Indirect Intersegment 11111111 mod011 = t/m 


Protected Mode Only (Indirect Intersegment) 


Via Call Gate to Same Privilege Level 

Via Call Gate to Different Privilege Level (No Parameters) 

Via Call Gate to Different Privilege Level (x Parameters) 

From 80286 Task to 80286 TSS 

From 80286 Task to Am386DX/DXL CPU TSS 

From 80286 Task to Virtual 8086 Task (Am386DX/DXL CPU TSS) 

From Am386DX/DXL CPU Task to 80286 TSS 

From Am386DX/DXL CPU Task to Am386DX/DXL CPU TSS 

From Am386DX/DXL CPU Task to Virtual 8086 Task (Am386DX/DXL CPU TSS) 


JMP = Unconditional Jump 


Short 11101011 8-bit displacement 


Direct within Segment 11101001 full displacement 


Register/Memory 11111111 mod100 t/m 
Indirect within Segment 


Direct Intersegment 11101010 unsigned full offset, selector 
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Table 23. Am386DX/DXL Microprocessor Instruction Set Summary (continued) 


Protected 
Virtual 


Instruction Format 
CONTROL TRANSFER (continued) 


Protected Mode Only (Direct Intersegment) 
Via Call Gate to Same Privilege Level 
From 80286 Task to 80286 TSS 
From 80286 Task to Am386DX/DXL CPU TSS 
From 80286 Task to Virtual 8086 Task (Am3886DX/DXL CPU TSS) 
From Am3886DX/DXL CPU Task to 80286 TSS 
From Am386DX/DXL CPU Task to Am3886DX/DXL CPU TSS 
From Am386DX/DXL CPU Task to Virtual 8086 Task (Am386DX/DXL CPU TSS) 


Indirect Intersegment xs ey a Ga Ica mod101 = t/m 


Protected Mode Only (Indirect Intersegment) 


Via Call Gate to Same Privilege Level 

From 80286 Task to 80286 TSS 

From 80286 Task to Am386DX/DXL CPU TSS 

From 80286 Task to Virtual 8086 Task (Am386DX/DXL CPU TSS) 

From Am386DX/DXL CPU Task to 80286 TSS 

From Am386DX/DXL CPU Task to Am3886DX/DXL CPU TSS 

From Am386DX/DXL CPU Task to Virtual 8086 Task (Am386DX/DXL CPU TSS) 


RET = Return from CALL 


Within Segment 

Within Seg. Adding Immediate to SP g,h,r 
Intersegment g,h,j,k,r 
Intersegment Adding Immediate to SP 


Protected Mode Only (RET) to Different Privilege Level 


Intersegment 
Intersegment Adding Immediate to SP 


CONDITIONAL JUMPS (Note: Times are Jump “Taken or Not Taken”) 


JO=Jump on Overflow 


8-bit Displacement 01110000 8 -bit displacement 
Full Displacement 00001111 10000000 full displacement 


JNO = Jump on Not Overflow 


8-bit Displacement 01110001 8 -bit displacement 
Full Displacement 00001111 10000001 full displacement 


JB/JNAE = Jump on Below/Not Above or Equal 


8-bit Displacement 01110010 8 -bit displacement 
Full Displacement 00001111 10000010 _ | full displacement 


JNB/JAE = Jump on Not Below/Above or Equal 


8-bit Displacement 01110011 
Full Displacement 00001111 10000011 full displacement 


JE/JZ=Jump on Equal/ Zero 


8-bit Displacement 01110100 8 -bit displacement 
Full Displacement 00001111 10000100 full displacement 


JNE/JNZ = Jump on Not Equal/Not Zero 


8-bit Displacement 01110101 8 -bit displacement 
Full Displacement 00001111 10000101 full displacement 


JBE/JNA = Jump on Below or Equal/Not Above 


8-bit Displacement 01110110 8 -bit displacement 
Full Displacement 00001111 10000110 full displacement 
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Table 23. Am386DX/DXL Microprocessor Instruction Set Summary (continued) 
Protected = 

Real Virtual Real 

Address | Address | Address | Address 
Instruction Format Mode Mode | Mode 
CONDITIONAL JUMPS (continued) 

JNBE/JA = Jump on Not Below or Equal/Above 

8-bit Displacement 7+m or 3 

Full Displacement full displacement 7+m or 3 

JS = Jump on Sign 

8 -bit Displacement 7+m or 3 

Full Displacement full displacement 7+m or 3 

JNS = Jump on Not Sign 

8 -bit Displacement 7+m or 3 

Full Displacement full displacement 7+m or 3 

JP/JPE = Jump on Parity/Parity Even 

8-bit Displacement 7+m or 3 

JNP/JPO= Jump on Not Parity/Parity Odd 

8 -bit Displacement 7+mor3 

Full Displacement full displacement 7+mor3 

JL/JNGE = Jump on Less/Not Greater or Equal 

8-bit Displacement 7+m or3 

Full Displacement full displacement 7+m or3 

8-bit Displacement 7+m or 3 

Full Displacement full displacement 7+m or 3 

JLE/JNG= Jump on Less or Equal/Not Greater 

8-bit Displacement 7+m or 3 

Full Displacement full displacement 7+m or3 
JNLE/JG= Jump on Not Less or Equal/Greater 


Full Displacement 00001111 10001010 full displacement 7+m or3 
JNL/JGE = Jump on Not Less/Greater or Equal 
8-bit Displacement 01111111 8 -bit displacement 7+m or3 


Full Displacement full displacement 7+m or 3 
JCXZ= Jump on CX Zero * 9+m or 5 
JECXZ = Jump on ECX Zero * 9+m or 5 | 
LOOP =Loop CX Times 114m 
LOOPZ/LOOPE =Loop with Zero/Equal 11 +m 
LOOPNZ/LOOPNE=Loop while Not Zero 114m 


CONDITIONAL BYTE SET (Note: Times are Register/Memory) 
SETO=Set Byte on Overflow 


To Register/Memory 00001111 10010000 mod000 t/m 


SETNO=Set Byte on Not Overflow 


To Register/Memory 00001111 10010001 mod000 f/m 


SETB/SETNAE =Set Byte on Below/Not Above or Equal 


To Register/Memory 00001111 10010010 mod000 t/m 


* Address Size Prefix Differentiates JCXZ from JECXZ. 
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Table 23. Am386DX/DXL Microprocessor Instruction Set Summary (continued) 


Instruction Format 
CONDITIONAL BYTE SET (continued) 


SETNB = Set Byte on Not Below/Above or Equal 

To Register/Memory 00001111 10010011 mod000 f/m 
SETE/SETZ =Set Byte on Equal/Zero 

To Register/Memory 00001111 10010100 mod000 tm 
SETNE/SETNZ =Set Byte on Not Equal/Not Zero 

To Register/Memory 00001111 10010101 mod000 t/m 
SETBE/SETNA =Set Byte on Below or Equal/Not Above 


To Register/Memory 00001111 10010110 mod000 f/m 


SETNBE/SETA =Set Byte on Not Below or Equal/Above 

To Register/Memory 00001111 mod000 tm 
SETS = Set Byte on Sign 

To Register/Memory 00001111 10011000 mod000 t/m 
SETNS = Set Byte on Not Sign 

To Register/Memory 00001111 10011001 mod000 f/m 
SETP/SETPE = Set Byte on Parity/Parity Even 

To Register/Memory 00001111 10011010 mod000 t/m 
SETNP/SETPO = Set Byte on Not Parity/Parity Odd 

To Register/Memory 00001111 10011011 mod000 tm 
SETL/SETNGE = Set Byte on Less/Not Greater or Equal 


To Register/Memory 00001111 10011100 mod000 t/m 


SETNL/SETGE = Set Byte on Not Less/Greater or Equal 


To Register/Memory 00001111 01111101 mod 00 0 rm 


SETLE/SETNG = Set Byte on Less or Equal/Not Greater 
To Register/Memory 00001111 10011110 mod000 t/m 
SETNLE/SETG = Set Byte on Not Less or Equal/Greater 


To Register/Memory 00001111 10011111 mod000 t/m 


ENTER = Enter Procedure 11001000 16-bit displacement, 8-bit level 


L=0 10 
L=1 12 
L>1 15+4(n-1) 


LEAVE = Leave Procedure 4 
INTERRUPT INSTRUCTIONS 
INT = Interrupt: 


Type Specited 
Types 
INTO =Interrupt 4 if Overflow Flag Set | 11001110 


If OF =1 
lf OF =0 
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Table 23. Am386DX/DXL Microprocessor Instruction Set Summary (continued) 


Protected 
Real Real 
Address Address | Address 
Instruction Format Mode Mode 


Virtual 
INTERRUPT INSTRUCTIONS (continued) 


Address 
Bound = Interrupt 5 if Detect 01100010 
Value Out of Range ~ 


Mode 
If Out of Range 44 
If in Range 10 












Protected Mode Only (INT) 


INT: Type Specified 

Via Interrupt or Trap Gate to Same Privilege Level 

Via Interrupt or Trap Gate to Different Privilege Level 

From 80286 Task to 80286 TSS via Task Gate 

From 80286 Task to Am386DX/DXL CPU TSS via Task Gate 

From 80286 Task to Virtual 8086 Mode via Task Gate 

From Am386DX/DXL CPU Task to 80286 TSS via Task Gate 

From Am386DX/DXL CPU Task to AmM386DX/DXL CPU TSS via Task Gate 
From Am3886DX/DXL CPU Task to Virtual 8086 Mode via Task Gate 

From Virtual 8086 Mode to 80286 TSS via Task Gate 

From Virtual 8086 Mode to Am386DX/DXL CPU TSS via Task Gate 

From Virtual 8086 Mode to Privilege Level 0 via Trap Gate or Interrupt Gate 


~ ~ 
- - 
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INT: Type 3 

Via Interrupt or Trap Gate to Same Privilege Level 

Via Interrupt or Trap Gate to Different Privilege Level 

From 80286 Task to 80286 TSS via Task Gate 

From 80286 Task to Am386DX/DXL CPU TSS via Task Gate 

From 80286 Task to Virtual 8086 Mode via Task Gate 

From Am386DX/DXL CPU Task to 80286 TSS via Task Gate 

From Am386DX/DXL CPU Task to Am3886DX/DXL CPU TSS via Task Gate 
From Am386DX/DXL CPU Task to Virtual 8086 Mode via Task Gate 

From Virtual 8086 Mode to 80286 TSS via Task Gate 

From Virtual 8086 Mode to Am3886DX/DXL CPU TSS via Task Gate 

From Virtual 8086 Mode to Privilege Level 0 via Trap Gate or Interrupt Gate 
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INTO 


Via Interrupt or Trap Gate to Same Privilege Level g,j,k,r 
Via Interrupt or Trap Gate to Different Privilege Level g,j,k,r 
From 80286 Task to 80286 TSS via Task Gate g,j,k,r 
From 80286 Task to Am386DX/DXL CPU TSS via Task Gate g,j,k,r 
From 80286 Task to Virtual 8086 Mode via Task Gate g,j,k,r 
From Am386DX/DXL CPU Task to 80286 TSS via Task Gate g,j,k,r 
From Am386DX/DXL CPU Task to Am386DX/DXL CPU TSS via Task Gate g,j,k,r 
From Am386DX/DXL CPU Task to Virtual 8086 Mode via Task Gate g,j,k,r 
From Virtual 8086 Mode to 80286 TSS via Task Gate g,j,k,r 
From Virtual 8086 Mode to Am386DX/DXL CPU TSS via Task Gate g,j,k,r 
From Virtual 8086 Mode to Privilege Level 0 via Trap Gate or Interrupt Gate g,j,k,r 





BOUND 

Via Interrupt or Trap Gate to Same Privilege Level 

Via Interrupt or Trap Gate to Different Privilege Level 

From 80286 Task to 80286 TSS via Task Gate 

From 80286 Task to Am386DX/DXL CPU TSS via Task Gate 

From 80286 Task to Virtual 8086 Mode via Task Gate 

From Am386DX/DXL CPU Task to 80286 TSS via Task Gate ; 
From Am386DX/DXL CPU Task to Am386DX/DXL CPU TSS via Task Gate 
From Am386DX/DXL CPU Task to Virtual 8086 Mode via Task Gate 

From Virtual 8086 Mode to 80286 TSS via Task Gate 

From Virtual 8086 Mode to Am386DX/DXL CPU TSS via Task Gate 

From Virtual 8086 Mode to Privilege Level 0 via Trap Gate or Interrupt Gate 


INTERRUPT RETURN 


IRET=!Interrupt Return 11001111 22 


Protected Mode Only (IRET) 
To the Same Privilege Level (within Task) 
To Different Privilege Level (within Task) 
From 80286 Task to 80286 TSS 
From 80286 Task to Am386DX/DXL CPU TSS 
From 80286 Task to Virtual 8086 Task 
From 80286 Task to Virtual 8086 Mode (within Task) 
From Am386DX/DXL CPU Task to 80286 TSS 
From Am386DX/DXL CPU Task to AmM386DX/DXL CPU TSS 275 
From Am386DX/DXL CPU Task to Virtual 8086 Task 223 
From Am386DX/DXL CPU Task to Virtual 8086 Mode (within Task) 


a a a 
ry 
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Se ee te 
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Table 23. Am386DX/DXL Microprocessor Instruction Set Summary (continued) 


Protected 
Virtual 
Address | Address] Address 
Instruction Format Mode 


PROCESSOR CONTROL 


HLT =HALT | 

MOV = Move to and From Control/Debug/Test Registers 

CRO/CR2/CR3 from register 00001111 00100010 11/4/5 
Register From CR3—0 00001111 6 
DR3—0 From Register 00001111 22 
DR7-6 From Register 00001111 16 
Register from DR7-6 00001111 14 
Register from DR3-—0 00001111 foo100001 | itecereg | 22 
TR7-6 from Register 00001111 12 
Register from TR7-6 00001111 


NOP = No Operation 10010000 


WAIT = Wait until BUSY 10011011 
pin is negated 


NOP = No Operation 10010000 


PROCESSOR EXTENSION INSTRUCTIONS 


Processor Extension Escape modLLL f/m | 


TTT and LLL bits are op-code information for coprocessor 
| PREFIX BYTES 


| Address Size Prefix 101100111 | 


LOCK = Bus Lock Prefix 11110000 | 


Operand Size Prefix 01100110 


Segment Override Prefix 


Cs: 00101110 

DS: 00111110 

ES: 00100110 

FS: 01100100 

GS: 01100101 

SS: 00110110 
PROTECTION CONTROL 


ARPL= Adjust Requested Privilege Level 


From Register/Memory 01100011 


LAR =Load Access Rights 


From Register/Memory 00001111 00000010 modreg  r/m g,h,j, p 


LGDT = Load Global Descriptor 


Table Register 00001111 00000001 mod010 = t/m hl 


LIDT = Load Interrupt Descriptor 


Table Register 00001111 00000001 mod011 = t/m h, | 


LLDT = Load Locai Descriptor 


Table Register to Register/Memory 00001111 00000000 mod010 tm 


LMSW =Load Machine Status Word 


From Register/Memory 100001111 00000001 mod110 t/m 
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Table 23. Am386DX/DXL Microprocessor Instruction Set Summary (continued) 


Instruction Format 
PROTECTION CONTROL (continued) 


LSL=Load Segment Limit 


Clock Count 


reg /m 


From Register/Memory 00001111 00000011 


Byte-Granular Limit 
Page-Granular Limit 
LTR =Load Task Register 


From Register/Memory 00001111 00000000 mod001 «t/m 


SGDT = Store Global Descriptor 


Table Register 00001111 00000001 mod000 t/m 


SIDT = Store Interrupt Descriptor 


| Table Register 00001111 00000001 mod001 = ft/m 


| SLDT =Store Local Descriptor Table Register 


| To Register/Memory 00001111 100000000 | modo000 tm 
SMSW =Store Machine Status Word] 00001111 00000001 mod100 t/m 


STR =Store Task Register 


To Register/Memory 00001111 00000000 mod001 = f/m 


VERR=Verify Read Access 


Notes h through r apply to Am386DX/DXL CPU Protected Virtual 
Address Mode only. 


Instruction Notes for Table 23. 


Notes a through c apply to Am386DX/DXL CPU Real Address 
Mode only. 


a. This is a Protected Mode instruction. Attempted execution in Real 
Mode will result in Exception 6 (Invalid op-code). 


b. Exception 13 fault (General Protection) will occur in Real Mode if 
an operand reference is made that partially or fully extends beyond 
the maximum CS, DS, ES, FS, or GS limit, FFFFH. Exception 12 
(fault stack segment limit violation or not present) will occur in Real 
Mode if an operand reference is made that partially or fully extends 
beyond the maximum SS limit. 


c. This instruction may be executed in Real Mode. In Real Mode, its 
purpose is primarily to initialize the CPU for Protected Mode. 


Notes d through g apply to Am386DX/DXL CPU Real Address 
Mode and Am386DX/DXL CPU Protected Virtual Address Mode. 


d. The Am386DX/DXL CPU uses an early-out multiply algorithm. 
The actual number of clocks depends on the position of the most 
significant bit in the operand (multiplier). 

Clock counts given are minimum to maximum. To calculate actual 
clocks, use the following formula: 

Actual Clock =if m < > 0 then max ([log2 |m{], 3) + b clocks: if m=0 
then 3+b clocks 

In this formula, mis the multiplier, and 

b =9 for register to register, 

b=12 for memory to register, 

b= 10 for register with immediate to register, 

b=11 for memory with immediate to register. 


e. An Exception may occur, depending on the value of the operand. 


f. LOCK is automatically asserted, regardless of the presence or 
absence of the LOCK prefix. 





g. LOCK is asserted during descriptor table accesses. 


h. 





Exception 13 fault (General Protection Violation) will occur if the 
memory operand in CS, DS, ES, FS, or GS cannot be used due to 
either a segment limit violation or access rights violation. If a stack 
limit is violated, an Exception 12 (Stack Segment Limit Violation or 
Not Present) occurs. 


For segment load operations, the CPL, RPL, and DPL must agree 
with the privilege rules to avoid an Exception 13 fault (General 
Protection Violation). The segment’s descriptor must indicate 
present or Exception 11 (CS, DS, ES, FS, GS Not Present). If the 
SS register is loaded and a stack segment not present is detected, 
an Exception 12 (Stack Segment Limit Violation or Not Present) 
occurs. 


All segment descriptor accesses in the GDT or LDT made by this 
instruction will automatically assert LOCK to maintain descriptor 
integrity in multiprocessor systems. 





. JMP, CALL, INT, RET, and IRET instructions referring to another 


code segment will cause an Exception 13 (General Protection 
Violation) if an applicable privilege rule is violated. 


An Exception 13 fault occurs if CPL is greater than 0 (0 is the most 
privileged level). 


. An Exception 13 fault occurs if CPL is greater than IOPL. 
. The IF bit of the flag register is not updated if CPL is greater than 


IOPL. The lOPL and VM fields of the flag register are updated only 
if CPL=0. 


. The PE bit of the MSW (CRO) cannot be reset by this instruction. 


Use MOV into CRO if desiring to reset the PE bit. 


. Any violation of privilege rules as applied to the selector operand 


does not cause a protection Exception; rather, the zero flag is 
cleared. 
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q. If the coprocessor’s memory operand violates a segment limit or 
segment access rights, an Exception 13 fault (General Protection 
Exception) will occur before the ESC instruction is executed. An 
Exception 12 fault (Stack Segment Limit Violation or Not Present) 
will occur if the stack limit is violated by the operand’s starting 
address. 


r. The destination of a JMP, CALL, INT, RET, or IRET must be in the 
defined limit of a code segment or an Exception 13 fault (General 
Protection Violation) will occur. 


Instruction Encoding 
Overview 


All instruction encodings are subsets of the general in- 
struction format shown in Figure 83. Instructions consist 
of one or two primary op-code bytes, possibly an ad- 
dress specifier consisting of the mod r/m byte and 
scaled index byte, a displacement if required, and anim- 
mediate data field if required. 


Within the primary op-code or op-codes, smaller encod- 
ing fields may be defined. These fields vary according to 
the class of operation. The fields define such informa- 
tion as direction of the operation, size of the displace- 
ments, register encoding, or sign extension. 


Almost all instructions referring to an operand in mem- 
ory have an addressing mode byte following the primary 
op-code byte(s). This byte, the mod r/m byte, specifies 
the address mode to be used. Certain encodings of the 
mod r/m byte indicate a second addressing byte, the 
scale-index-base byte, follows the mod r/m byte to fully 
specify the addressing mode. 


Addressing modes can include a displacement immedi- 
ately following the mod r/m byte, or scaled index byte. If 
a displacement is present, the possible sizes are 8, 16, 
or 32 bits. 


If the instruction specifies an immediate operand, the 
immediate operand follows any displacement bytes. 
The immediate operand, if specified, is es the last 
field of instruction. 


Figure 83 illustrates several of the fields that can appear 
in an instruction, such as the mod field and the r/m field, 
but the Figure does not show all fields. Several smaller 
fields also appear in certain instructions, sometimes 


within the op-code bytes themselves. Table 24 is acom- 
plete list of all fields appearing in the AmM386DX/DXL mi- 
croprocessor instruction set. Further ahead, following 
Table 24, are detailed tables for each field. 


32-Bit Extensions of the Instruction Set 


With the Am386DX/DXL microprocessor, the 8086/ 
80186/80286 instruction set is extended in two ortho- 
gonal directions: 32-bit forms of all 16-bit instructions 
are added to support the 32-bit data types, and 32-bit 
addressing modes are made available for all instruc- 
tions referencing memory. This orthogonal instruction 
set extension is accomplished having a Default (D) bit in 
the code segment descriptor, and by having 2 prefixes 
to the instruction set. 


Whether the instruction defaults to operations of 16 or 
32 bits depends on the setting of the D bit in the code 
segment descriptor, which gives the default length 
(either 32 or 16 bits) for both operands and effective ad- 
dresses when executing that code segment. Inthe Real 
Address Mode or Virtual 8086 Mode, no code segment 
descriptors are used, but a D value of 0 is assumed in- 
ternally by the Am386DX/DXL microprocessor when 
operating in those modes (for 16-bit default sizes com- 
patible with the 8086/80186/80286). 


Two prefixes, the Operand Size Prefix and the Effective 
Address Size Prefix, allow overriding individually the 
Default selection of operand size and effective address 
size. These prefixes may precede any op-code bytes 
and affect only the instruction they precede. If neces- 
sary, one or both of the prefixes may be placed before 
the op-code bytes. The presence of the Operand Size 
Prefix and the Effective Address Prefix will toggle the 
operand size or the effective address size, respectively, 
to the value opposite from the Default setting. For exam- 
ple, if the default operand size is for 32-bit data opera- 
tions, then presence of the Operand Size Prefix toggles 
the instruction to 16-bit data operation. As another 
example, if the default effective address size is 16 bits, 
presence of the Effective Address Size prefix 
toggles the instruction to use 32-bit effective address 
computations. 


TTTTTTTQTMITTTITTttTqtTqt mod TTT r/m d32|16| 8 [none data 32| 16 | 8 | none 


7 0 7 0765320 7653 20 
a | 
opcode mod r/m s-i-b address immediate 
(one or two bytes) byte byte displacement data 
(T represents an opcode bit) $$$ ———_—___—_———”—_s 4, 2, 1 bytes (4, 2, 1 bytes 
register and address or none) or none) 
mode specifier 
15021B—085 


Figure 83. General Instruction Format 
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Table 24. Fields within Am386DX/DXL Microprocessor Instructions 


Field Name Number of Bits 


Specifies if Data is Byte or Full Size (Full Size is either 16 or 32 bits) 1 
Specifies Direction of Data Operation 1 
Specifies if an Immediate Data Field must be Sign-Extended 1 
General Register Specifier 3 
Address Mode Specifier (Effective Address can be a General Register) 2 for mod; 


3 for r/m 


Scale Factor for Scaled Index Address Mode 2 
General Register to be used as Index Register 

General Register to be used as Base Register 

Segment Register Specifier for CS, SS, DS, ES 

Segment Register Specifier for CS, SS, DS, ES, FS, GS 

For Condition Instructions, specifies a Condition Asserted or a Condition Negated 





Note: Table 23 shows encoding of individual instructions. 


These 32-bit extensions are available in all AmM386DX/ Encoding of reg Field When w Field 

DXL microprocessor modes, including the Real Ad- is not Present in Instruction 

dress Mode or the Virtual 8086 Mode. In these modes 

the default is always 16 bits, so prefixes are needed to Register Selected | Register Selected 


: ; During 16-Bit During 32-Bit 
specify 32-bit operands or addresses. For instructions ; ; 
with more than one prefix, the order of prefixes is fea. Bie pata Operation’ | vata Opeletions 
unimportant. 


Unless specified otherwise, instructions with 8- and 
16-bit operands do not affect the contents of the high- 
order bits of the extended registers. 

Encoding of Instruction Fields 

Within the instruction are several fields indicating regis- 
ter selection, addressing mode and so on. The exact en- 
codings of these fields are defined immediately ahead. 


Encoding of Operand Length (w) Field Encoding of reg Field When w Field 
For any given instruction performing a data operation, is Present in Instruction © 


the instruction is executing as a 32- or 16-bit operation. Register Specified by reg Field 
During 16-Bit Data Operations | 


Within the constraints of the operation size, the w field 
encodes the operand size as either one byte or the full - 
Function of w Field 


operation size, as shown in the table below. 
AL 


CL 
DL 
BL 
AH 
CH 
DH 
BH 














Operand Size Operand Size 
During 16-Bit During 32-Bit 
Data Operations | Data Operations 





Encoding of The General Register (reg) Field 


The general register is specified by the reg field, which 
may appear in the primary op-code bytes, or as the reg 
field of the mod r/m byte, or as the r/m field of the mod 
r/m byte. 
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Register Specified by reg Field 
During 32-Bit Data Operations © 


Function of w Field 





Encoding of The Segment Register (sreg) Field 


The sreg field in certain instructions is a 2-bit field allow- 
ing one of the four 80286 segment registers to be speci- 
fied. The sreg field in other instructions is a 3-bit field, al- 
lowing the Am386DX/DXL microprocessor FS and GS 
segment registers to be specified. 


2-Bit sreg2 Field 
2-Bit sreg2 Field 


00 ES 
01 CS 
10 SS 
11 DS 


Segment Register Selected 


3-Bit sreg3 Field 


3-Bit sreg3 Field 


Segment Register Selected 


do not use 
do not use 








Encoding of Address Mode 


Except for special instructions, such as PUSH or POP, 
where the addressing mode is pre-determined, the ad- 
dressing mode for the current instruction is specified by 
addressing bytes following the primary op-code. The 
primary addressing byte is the mod r/m byte, and a sec- 
ond byte of addressing information, the scale-index- 
base (s-i-b) byte, can be specified. 


The s-i-b byte is specified when using 32-bit addressing 
mode andthe mod r/m byte has r/m = 100 and mod = 00, 
01, or 10. When the s-i-b byte is present, the 32-bit ad- 
dressing mode is a function of the mod, ss, index, and 
base fields. 


The primary addressing byte, the mod r/m byte, also 
contains three bits (Shown as TTT in Figure 83) some- 
times used as an extension of the primary op-code. The 
three bits, however, may also be used as a register 
field (reg). 


When calculating an effective address, either 16-bit ad- 
dressing or 32-bit addressing is used. 16-bit addressing 
uses 16-bit address components to calculate the effec- 
tive address while 32-bit addressing uses 32-bit ad- 
dress components to calculate the effective address. 
When 16-bit addressing is used, the mod r/m byte is in- 
terpreted as a 16-bit addressing mode specifier. When 
32-bit addressing is used, the mod r/m byte is inter- 
preted as a 32-bit addressing mode specifier. 


Tables on the following pages define all encodings of all 
16- and 32-bit addressing modes. 





132 Am386 Microprocessors for Personal Computers 


AMD cl 


Encoding of 16-Bit Address Mode with mod r/m Byte 


Effective Address Effective Address 


DS:[BX + SI] DS{BX + SI + d16] 
DS‘[BX + DI] DS{BX + Dl + d16] 
SS:[BP + Sl] SS:[BP + SI + d16] 
DS:[BP + Di] SS:[BP + Di +d16] 
DS{SI] DS{SI + d16] 
DS{DI] DS[D! + d16] 
DS:d16 SS:[BP + d16] 
DS{[BX + d16] 


DS{BX] 


DS{BX + SI + d8] 
DS:[BX + Di +d8] 
SS:[BP + SI + d8] 
SS:[BP + DI + d8] 
DS{SI + d8] 

DS {DI + d8} 
SS:[BP + d8] 
DS{[BX + d8] 


Register Specified by r/m 
During 32-Bit Data Operations 
Function of w Field 
oo TC Re 


Register— See Below 
Register— See Below 
Register— See Below 
Register— See Below 
Register— See Below 
Register— See Below 
Register— See Below 
Register— See Below 


Register Specified by r/m 
During 16-Bit Data Operations 
Function of w Field 
mod tim |" (whenw=0) | (whenw=1) 
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Encoding of 32-Bit Address Mode with mod r/m byte 
(No s-i-b Byte Present) 


DS:[EAX] 
DS{ECX] 
DS:[EDX] 
DS{EBX] 

s-i-b is present 
DS:d32 
DSES]] 
DS-:(EDI] 


Etfective Address 


DS{EAX + d32] 
DS:[ECX + d32] 
DSEDX + d32] 
DS[EBX + d32] 
s-i-b is present 
SS:[EBP + d32] 
DS:[ESI + d32] 
DS:[EDI + d32] 


DS:[EAX + d8] Register— See Below 
DS:[ECX + d8] | : | Register—See Below 
DS:[EDX + d8] Register— See Below 
DS[EBX + d8] ; | Register— See Below 
s-i-b is present ; | | Register— See Below 
SS:[EBP + d8] | Register—See Below 
DS:([ESI + d8] Register— See Below 
DS:[EDI + d8] Register— See Below 


Register Specified by reg or r/m Register Specified by reg or r/m 
During 32-Bit Data Operations During 16-Bit Data Operations 
Function of w Field Function of w Field | 
ae [whenw=0) | (whenw=t) | 
AL AX 






















134 Am386 Microprocessors for Personal Computers 


AMD cl 


Encoding of 32-Bit Address Mode (mod r/m Byte and s-i-b present) 


Effective Address 


DS:[EAX + (scaled index)] 
DS:[ECX + (scaled index)] 
DS:[EDX + (scaled index)] 
DS:[EBX + (scaled index)] 
SS:[ESP + (scaled index)] 
DS:[d32 + (scaled index)] 
DS:[ESI + (scaled index)] 
DS:[EDI + (scaled index)] 


DS:[EAX + (scaled index) + d8] 
DS:[ECX + (scaled index) + d8] 
DS:[EDX + (scaled index) + d8] 
DS:[EBX + (scaled index) + d8] 
SS:[ESP + (scaled index) + d8] 
SS:[EBP + (scaled index) + d8] 
DS:[ESI + (scaled index) + d8] 

DS:[EDI + (scaled index) + d8] 


DS:[EAX + (scaled index) + d32] 
DS:[ECX + (scaled index) + d32] 
DS:[EDX + (scaled index) + d32] 
DS:[EBX + (scaled index) + d32] 
SS:[ESP + (scaled index) + d32] 
SS:[EBP + (scaled index) + d32] 
DS:[ESI + (scaled index) + d32] 

DS:[EDI + (scaled index) + d32] 





Note: Mod field in mod r/m byte; ss, index, base fields in s-i-b byte. 


Encoding of Operation Direction (d) Field 


In many two-operand instructions the d field is present 
to indicate which operand is considered the source and 
which is the destination. 


fd | Direction of Operation 


Register/Memory €— Register 
reg Field indicates Source Operand; 

mod r/m or mod ss index base indicates 
Destination Operand. 











Register €— Register Memory 
reg Field indicates Destination Operand; 

mod r/m or mod ss index base indicates Source 
Operand. 








00 x1 
01 x2 
10 x4 






11 


EAX 
ECX 
EDX 





EBX 
no index reg (see note) 
EBP 
ESI 
EDI 





Note: When index field is 100, indicating no index register, then ss field 
must equal 00. If index is 100 and ss does not equal 00, the effective 
address is undefined. 


Encoding of Sign-Extend (s) Field 


The s field occurs primarily to instructions with immedi- 
ate data fields. The s field has an effect only if the size of 
the immediate data is 8 bits and is being placed in a 16- 
or 32-bit destination. 


Effect on Effect on 
immediate Data 8 immediate Data 16/32 
1 | Sign-Extended Data 8 to fill 
16-Bit or 32-Bit Destination 
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Encoding of Conditional Test (tttn) Field 


For the conditional instructions (conditional jumps and 
set on condition), tttn is encoded with n indicating to use 
the condition (n=0) or its negation (n=1), and ttt giving 
the condition to test. 


Overflow 

No Overflow 

Below/Not Above or Equal 

Not Below/Above or Equal 
Equal/Zero 

Not Equal/Not Zero 

Below or Equal/Not Above 

Not Below or Equal/Above 

Sign 

Not Sign 

Parity/Parity Even 

Not Parity/Parity Odd 

Less Than/Not Greater or Equal 

Not Less Than/Greater or Equal 

Less Than or Equal/Not Greater Than 
Not Less Than or Equal/Greater Than | 





Encoding of Control or Debug or Test Register 
(eee) Field 


For the loading and storing of the Control, Debug and 
Test registers. 


When Interpreted as Control Register Field 


[wwecode [ogame | 


000 CRO 
010 CR2 
011 CR3 


Do not use any other encoding. 









When Interpreted as Debug Register Field 









a 
TR6 | 
TR7 


Do not use any other encoding. 
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MECHANICAL DATA 


introduction 
In this section, the physical packaging and its connec- 
tions are described in detail. 


Package Dimensions and Mounting 
The initial AM386DX/DXL microprocessor package is a 
132-pin ceramic pin grid array (PGA). Pins of this pack- 
age are arranged 0.100 inch (2.54 mm) center-to- 
center, in a 14 x 14 matrix, three rows around. 


A wide variety of available sockets allow low insertion 
force or zero insertion force mountings, and a choice of 
terminals such as soldertail, surface mount, or wire 
wrap. 


Package Thermal Specification 

The Am386DX/DXL microprocessor is specified for 
operation when ambient temperature is within the range 
of 0°C—100°C. The ambient temperature may be meas- 
ured in any environment, to determine whether the 
Am386DX/DXL microprocessor is within specified oper- 
ating range. 

The PGA ambient temperature should be measured at 
the center of the top surface opposite the pins. 


ELECTRICAL DATA 


Introduction 

The following sections describe recommended electri- 
cal connections for the Am386DX/DXL microprocessor 
and its electrical specifications. 


Power and Grounding 
Power Connections 


The Am386DX/DXL CPU is implemented in CS21S 
technology and has modest power requirements. How- 
ever, its high clock frequency and 72 output buffers (ad- 
dress, data, control, and HLDA) can cause power 
surges as multiple output buffers drive new signal levels 
simultaneously. For clean on-chip power distribution at 
high frequency, 20 Vcc and 21 Vss pins separately feed 
functional units of the Am386DX/DXL CPU. 


Power and ground connections must be made to all 
external Vcc and GND pins of the Am386DX/DXL CPU. 
On the circuit board, all Vcc pins must be connected ona 
Vcc plane. All Vss pins must be likewise connected to the 
GND plane. 


amp @N 


Power Decoupling Recommendations 


Liberal decoupling capacitance should be placed near 
the Am386DX/DXL CPU. The Am386DX/DXL micro- 
processor driving its 32-bit parallel address and data 
buses at high frequencies can cause transient power 
surges, particularly when driving large capacitive loads. 


Low inductance capacitors and interconnects are rec- 
ommended for best high frequency electrical perform- 
ance. Inductance can be reduced by shortening circuit 
board traces between the Am386DX/DXL microproces- 
sor and decoupling capacitors as much as possible. Ca- 
pacitors specifically for PGA packages are also com- 
mercially available, for the lowest possible inductance. 


Resistor Recommendations 


The ERROR, FLT, and BUSY inputs have resistor 
pull-ups of approximately 20 Kohms built into the 
Am386DX/DXL CPU to keep these signals negated 
when no 387DX math coprocessor is present in the sys- 
tem (or temporarily removed from its socket). The BS16 
input also has an internal pull-up resistor of approxi- 
mately 20 Kohms, and the PEREQ input has an internal 
pull-down resistor of approximately 20 Kohms. 


In typical designs, the external pull-up resistors are re- 
commended. However, a particular design may have 
reason to adjust the resistor values recommended here, 
or alter the use of pull-up resistors in other ways. 


Other Connection Recommendations 


For reliable operation, always connect unused inputs to 
an appropriate signal level. NC pins should always re- 
main unconnected. 


Particularly when not using interrupts or bus hold, (as 
when first prototyping, perhaps) prevent any chance of 
spurious activity by connecting these associated inputs 
to GND. 


Pin Signal 
B7 INTR 
B8 NMI 
D14 HOLD 


If not using address pipelining, pull-up D13 NA to Vcc. 
If not using 16-bit size, pull-up C14 BS16 to Vcc. 
Pull-ups in the range of 20 Kohms are recommended. 
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PHYSICAL DIMENSIONS 
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PHYSICAL DIMENSIONS (continued) 


PQB 132—Plastic Quad Flat Pack (Trimmed and Formed) 








0.130 | 0.160 
0.150 | 0.180 
CF 43 
7/28/92 SG 
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PHYSICAL DIMENSIONS (continued) 


PQB 132— Plastic Quad Flat Pack with Molded Carrier Ring 
(Outer Ring measured in millimeters) 


a ee ee 
45.50 46.13 
45.90 41.37 
37.87 41.63 
35.15 __ 38.00 
35.25 32.15 
1.097 32.25 
0.944 1.103 
0.952 





45.50 | 37.87 | 32.15 | 0.944 
| 45.90 | 38.00 | 32.25 | 0.952 


45.87 | 41.37 | 35.15 | 1.097 








0.008 
46.13 | 41.63| 35.251 1.103 0.012 
= 7 
| 
| 
} 
] 
| 
| 
a) 
025 NOM 
TOP VIEW 9.008 
0.45 Typ 0.016 
65 Pitch 
r-ep— 2.00 4.80 
tt 1.80 
0.65 Typ o00 | 
oe SIDE VIEW 
nea 
a ae panes | 
14826E 
CB 51 
7/28/92 SG 
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Am386'™SX/SXL 


High-Performance, 32-Bit Microprocessor 


with 16-Bit Data Bus 


DISTINCTIVE CHARACTERISTICS 
@ 40-, 33-, 25-, and 20-MHz operating speeds 


m™ True static design for long battery life in 
portable PCs 


—0 MHz (DC) minimum frequency 
—Typical standby (DC) current < 20 pA 


—Typical operating current < 165 mA at 20 MHz 


—Wide range of chip set and BIOS support take 
advantage of standby mode capabilities 


GENERAL DESCRIPTION 


The Am386SX/SXL microprocessor is a high-speed, 
true static implementation of the Intel i886SX. It is ideal 
for both desktop and battery-powered notebook 
personal computers. For notebooks, the Am386SXL 
microprocessor’s true static design offers longer battery 
life with low operating power consumption and standby 
mode. At 20 MHz, this device offers a current which is 
22% lower than the Intel i886SX. Standby mode allows 
the Am386SXL CPU to be clocked down to 0 MHz (DC) 
and retain full register contents. Typical current in 
standby mode is reduced to less than 20 nA—nearly a 
1000x reduction in power consumption versus the 
Intel i8386SX. 


Advanced 
Micro 
Devices 


m Lower heat dissipation facilitates elimination of 
cooling fan in desktop PCs 


m Pin-for-pin replacement of the Intel i386SX 


= Supports 387SX-compatible math 
coprocessors 


B 100-pin PQFP package with optional protective 
ring for better lead coplanarity 


@ AMD advanced 0.8 micron CMOS technology 


For desktop PCs, the Am3886SX/SXL microprocessor 
offers a 21% increase in the maximum operating speed, 
from 33 to 40 MHz. Also, this device offers lower heat 
dissipation, allowing system designers to remove or re- 
duce the size and cost of the cooling fan. 


This device will be available in a standard 100-pin 
Plastic Quad Flat Pack (PQFP). This package may be 
shipped in an optional protective ring for better lead 
protection during manufacturing. 


Typical Power Consumption 


250 

200 

lee (MA) 150 
100 

50 

0 


0 2 16 20 


Note: Inputs at Vcc or Vss. Frequency (MHz) 


Publication#: 15022 Rev.D Amendment: /0 
issue Date: October 1992 


(Am386SX microprocessor only) 


Oo Intel i3886SX @ 5.0 V 


A Am386SX/SXL CPU @ 5.0 V} 
O Am386SXLV CPU @ 3.3 V 
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LOGIC SYMBOL 


2X Clock 


Data Bus 


Address Bus 


Am386SX/SXL 


AMD al 


Float 


Math 
Coprocessor 
Control 


Interrupt Control 


Microprocessor 


Bus Cycle 
Definition 


Bus Cycle Control 


FUNCTIONAL DESCRIPTION 


True Static Operation (Am386SXL CPU) 


The Am386SXL microprocessor incorporates a true 
static design. Unlike dynamic circuit design, the 
Am886SXL CPU eliminates the minimum operating 
frequency restriction. It may be clocked from its maxi- 
mum speed of 40 MHz all the way down to 0 MHz 
(DC). System designers can use this feature to design 
battery-powered notebook PCs with long battery life. 


Standby Mode (Am386SXL CPU) 


This true static design allows for a standby mode. At any 
operating speed (40 to 0 MHz), the Am386SXL micro- 
processor will retain its state (i.e., the contents of all 
its registers). By shutting off the clock completely, the 
device enters standby mode. Since power consumption 
is proportional to clock frequency, operating power 
consumption is reduced as the frequency is lowered. 
In standby mode, typical current draw is reduced to 
less than 20 pA at DC. 


Not only does this feature improve battery life, but it also 
simplifies the design of power-conscious notebook 
computers in the following ways: 
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NA 


Bus 
Arbitration 
Control 


READY 
15022B—003 


1. Eliminates the need for software in the BIOS to save 
and restore the contents of registers. 


2. Allows simpler circuitry to control stopping of the 
clock since the system does not need to know what 
state the processor is in. 


Lower Operating Icc (Am386SXL CPU) 


True static design also allows lower operating Icc when 
operating at any speed. See the following graph for 
typical current at operating speeds. 


Performance On Demand (Am386SXL CPU) 


The Am386SXL microprocessor retains its state at any 
speed from 0 MHz (DC) to its maximum operating 
speed. With this feature, system designers may vary the 
operating speed of the system to extend the battery life 
in portable systems. 


For example, the system could operate at low speeds 
during inactivity or polling operations. However, upon 
interrupt, the system clock can be increased up to its 
maximum speed. After a user-defined time-out period, 
the system can be returned to a low (or 0 MHz) oper- 
ating speed without losing its state. This design maxi- 
mizes battery life while achieving optimal performance. 
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CONNECTION DIAGRAMS 
Top Side View — 100-Lead Plastic Quad Flat Pack 


100 {[-_] D1 
99 [_] D2 
98 (__] Vss 
97 [__] Vcc 
96 L_] D3 
95 C_] D4 
94] D5 
93L_] D6 
92 [__] D7 
91] Veco 
90 C_] D8 
89 [J D9 
88 (__] D10 
87 CL] D111 
86 C_] D12 
85 C_] Vss 
84 [__] Vcc 
83 (__] D13 
82f__] D114 
81 (_] D1i5 
80 L_] A23 
79 CJ A22 
78 1] Vss 
77 L__! Vss 
76C_] A21 


1 
2 
3 
4 
5 
6 
z 
8 


Top Side View 


36 


PEREQ [_] 37 





N/C EC] 27 
NC LJ 29 
NC EL] 30 
Nc EC] 31 


Voc 


RESET C2] 33 
Vss [J 35 


Lock Co 
FLT Lu 

BUSY LIJ 
NMI C=] 38 
Vee [5] 39 
INTR EL] 40 
Vss CJ 41 
Veo EL] 42 
NC C2] 43 
NC Cj 44 
Nc C] 45 
NC [Cj 46 
NC CJ 47 
Veo EC] 48 
Vss [2] 49 
Vss [J 50 





ERROR Lu 


Notes: Pin 1 is marked for orientation. 
NC = Not connected; connection of an NC pin may cause a malfunction or incompatibility 
with future shippings of the Am386SX/SXL microprocessor. 
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CONNECTION DIAGRAMS (continued) 
Pin Side View — 100-Lead Plastic Quad Flat Pack 





7 ie Of 

Boboog shh EBS sE 2 scoggosss 
SELLE LEE EEE 
Lae oOo Mowe eo eee SSae Ses es 





WR Co Led §=A2 
De CO J] A3 
Mio Co T] A4 
Vss [J rt 6A 
Veco [J r) AG 
NC Co Tj A7 
BHE Co Tr] Vec 
Al Co Lt A8 
BCE Lo Lt AQ 
ADS LW [J A10 
CLK2 LJ —) Alt 
Vss [J | | A112 
Vss CO Pin Side View LI Vss 
Vss Lo T—] A13 
Vss LJ T_] A14 
Veo [I T] A15 
Veo [LJ 9 | Vss 
Veo [2] 8 Te) 6UVss 
READY Cj 7 | Voc 
NA (76 —] A16 
Vss [1] 5 ] Vcc 
HOLD [7 4 ] A17 
HLDA C23 LL} A18& 
Vss [J 2 Tr} A19 
Ld = 


Di Lj 100 
D2C] 99 
Vss _] 98 
Veco [E] 97 
D3 CL] 96 

D4] 95 

D5C ] 94 
D6 LC] 93 
D7] 92 

Vec EJ] 91 

Ds [_] 90 
DS C_} 89 

D10C_J 88 

D111] 87 

D12 Lj 86 
Vss [2] 85 

Vec Ll] 84 
D13[] 83 

D14(-] 82 
Di5C) 381 

A23 [_] 80 

A22 C_] 79 
Vss L_] 78 
Vss LJ 77 
A21 EC] 76 


Notes: Pin 1 is marked for orientation. 
NC = Not connected; connection of an NC pin may cause a malfunction 
or incompatibility with future shippings of the Am386SX/SXL microprocessor. 
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PIN DESIGNATION TABLES (sorted by Functional Grouping) 
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ORDERING INFORMATION 
Standard Products 


AMD al 


AMD standard products are available in several packages and operating ranges. The order number (Valid Combination) is 


formed by a combination of the elements below. 


NG 80386SX/SXL -20 


Valid Combinations 


80386SX —40, —40/F 


—33, -33/F 
—25, -25/F 
—20, -20/F 
—16", -16/F* 


NG | 80386SX/SXL 


*Contact AMD for 16-MHz availability. 





OPTIONAL PROCESSING 
None = Trimmed and Formed PQFP in high-temp trays 
/F = Ringed PQFP in horizontal tubes 


TEMPERATURE RANGE 
Blank = Commercial (0°C to +100°C) 


SPEED OPTION 


—40= 40 MHz (Am386SX microprocessor only) 
-33=33 MHz 

—25 = 25 MHz 

—20=20 MHz 

-16=16 MHz* 


DEVICE NUMBER/DESCRIPTION 
80386SX/SXL 

Am386SX/SXL High-Performance, 
Low-Power, 32-Bit Microprocessor with 
16-Bit Data Bus 


PACKAGE TYPE 
NG=100-Pin Plastic Quad Flat Pack (PQB100) 


Valid Combinations 


Valid Combinations list configurations planned to 
be supported in volume for this device. Consult 
the local AMD sales office to confirm availability of 
specific valid combinations and to check on newly 
released combinations. 
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PIN DESCRIPTIONS 


A23-A1 
Address Bus (Outputs) 


Outputs physical memory or port I/O addresses. 


ADS 

Address Status (Active Low; Output) 

Indicates that a valid bus cycle definition and address 
(W/R, D/C, M/1O, BHE, BLE, and A23-A1) are being 
driven at the AmM386SX/SXL microprocessor pins. 


BHE, BLE 
Byte Enables (Active Low; Outputs) 


Indicate which data bytes of the data bus take part 
in a bus cycle. 


BUSY 
Busy (Active Low; Input) 


Signals a busy condition from a processor extension. 


CLK2 

CLK2 (Input) 

Provides the fundamental timing for the Am386SX/SXL 
microprocessor. 


D15—D0 

Data Bus (Inputs/Outputs) 

Inputs data during memory, 1|/O, and_ interrupt 
acknowledge read cycles; outputs data during memory 
and 1/O write cycles. 


D/c 

Data/Control (Output) 

Abus cycle definition pin that distinguishes data cycles, 
either memory or I/O, from control cycles which are: 
interrupt acknowledge, halt, and code fetch. 


ERROR 
Error (Active Low; Input) 


Signals an error condition from a processor extension. 


FLT 
Float (Active Low; Input) 


An input which forces all bidirectional and output 
signals, including HLDA, to the three-state condition. 


HLDA 

Bus Hold Acknowledge (Active High; Output) 
Output indicates that the Am386SX/SXL microproces- 
sor has surrendered control of its logical bus to another 
bus master. 


HOLD 
Bus Hold Request (Active High; Input) 


Input allows another bus master to request control of the 
local bus. 


INTR 

Interrupt Request (Active High; Input) 

A maskable input that signals the Am386SX/SXL micro- 
processor to suspend execution of the current program 
and execute an interrupt acknowledge function. 


LOCK 
Bus Lock (Active Low; Output) 
A bus cycle definition pin that indicates that other 


system bus masters are not to gain control of the 
system bus while it is active. 


Mio 

Memory/lO (Output) 

A bus cycle definition pin that distinguishes memory 
cycles from input/output cycles. 


NA 
Next Address (Active Low; Input) 
Used to request address pipelining. 


NC 

No Connect 

Should always be left unconnected. Connection of a NC 
pin may cause the processor to malfunction or be 
incompatible with future steppings of the Am386SX/ 
SXL microprocessor. 


NMI 

Non-Maskablie Interrupt Request 

(Active High; Input) 

A non-maskable input that signals the Am386SX/SXL 
microprocessor to suspend execution of the current 
program and execute an interrupt acknowledge 
function. 


PEREQ m 

Processor Extension Request (Active High; Input) 
Indicates that the processor has data to be transferred 
by the Am386SX/SXL microprocessor. 


READY 
Bus Ready (Active Low; Input) 


Terminates the bus cycle. 


148 Am386 Microprocessors for Personal Computers 


RESET 

Reset (Active High; Input) 

Suspends any operation in progress and places the 
Am386SX/SXL microprocessor in a known reset state. 


Vee 
System Power (Input) 


Provides the +5 V nominal DC supply input. 


AMD cl 
Vss 
System Ground (Input) 


Provides the 0 V connection from which all inputs and 
outputs are measured. 


W/R 
Write/Read (Output) 


Abus cycle definition pin that distinguishes write cycles 
from read cycles. 
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INTRODUCTION 


The Am386SX/SXL microprocessor is 100% object- 
code compatible with the Am386DX/DXL, 286, and 
8086 microprocessors. System manufacturers can 
provide Am386DX/DXL CPU-based systems optimized 
for performance and Am386SX/SXL CPU-based sys- 
tems optimized for cost, both sharing the same 
operating systems and application software. Systems 
based on the Am386SX/SXL microprocessor can 
access the world’s largest existing microcomputer 
software base. 


Instruction pipelining, high-bus bandwidth, and a very 
high-performance ALU ensure short average instruction 
execution times and high system throughput. The 
Am386SX/SXL CPU is capable of execution at 
sustained rates of 2.5-3.0 million instructions per 
second (MIPS). 


The integrated Memory Management Unit (MMU) 
includes an address translation cache, advanced multi- 
tasking hardware, and a four-level hardware-enforced 
protection mechanism to support operating systems. 
The virtual machine capability of the Am386SX/SXL 
CPU allows simultaneous execution of applications 
from multiple operating systems such as MS-DOS and 
UNIX. 


The Am386SX/SXL CPU offers on-chip testability and 
debugging features. Four breakpoint registers allow 
conditional or unconditional breakpoint traps on code 
execution or data accesses for powerful debugging of 
even ROM-based systems. Other testability features 
include self-test, three-state of output buffers, and direct 
access to the page translation cache. 


BASE ARCHITECTURE 


The Am386SX/SXL microprocessor consists of a cen- 
tral processing unit, a Memory Management Unit, anda 
bus interface. 


The central processing unit consists of the execution 
unit and the instruction unit. The execution unit contains 
the eight 32-bit general purpose registers which are 
used for both address calculation and data operations 
and a 64-bit barrel shifter used to speed shift, rotate, 
multiply, and divide operations. The instruction unit 
decodes the instruction op-codes and stores them inthe 
decoded instruction queue for immediate use by the 
execution unit. 


The MMU consists of a segmentation unit and a paging 
unit. Segmentation allows the managing of the logical 
address space by providing an extra addressing 
component, one that allows easy code and data 
relocatability, and efficient sharing. The paging 
mechanism operates beneath and is transparent to the 
segmentation process, to allow management of the 
physical address space. 


The segmentation unit provides four levels of protection 
for isolating and protecting applications and the 
operating system from each other. The hardware 
enforced protection allows the design of systems with a 
high degree of integrity. 


The Am386SX/SXL microprocessor has two modes of 
operation: Reai Address Mode (Real Mode) and 
Protected Virtual Address Mode (Protected Mode). In 
Real Mode the Am386SX/SXL CPU operates as a very 
fast 8086, but with 32-bit extensions, if desired. Real 
Mode is required primarily to set up the processor for 
Protected Mode operation. 


Within Protected Mode, software can perform a task 
switch to enter into tasks designated as Virtual 8086 
Mode tasks. Each such task behaves with 8086 
semantics, thus allowing 8086 software (an application 
program or an entire operating system) to execute. The 
Virtual 8086 tasks can be isolated and protected from 
one another and the host AM3886SX/SXL microproces- 
sor operating system by use of paging. 


Finally, to facilitate high-performance system hardware 
designs, the Am3886SX/SXL microprocessor bus 
interface offers address pipelining and direct Byte 
Enable signals for each byte of the data bus. 


Register Set 


The Am386SX/SXL microprocessor has 34 registers as 
shown in Figure 1. These registers are grouped into the 
following seven categories: 


General Purpose Registers: The eight 32-bit general 
purpose registers are used to contain arithmetic and 
logical operands. Four of these (EAX, EBX, ECX, and 
EDX) can be used either in their entirety as 32-bit 
registers, as 16-bit registers, or split into pairs of 
separate 8-bit registers. 


Segment Registers: Six 16-bit special purpose 
registers select, at any given time, the segments of 
memory that are immediately addressable for code, 
stack, and data. 


Flags and Instruction Pointer Registers: The two 
32-bit special purpose registers in Figure 1 record or 
control certain aspects of the Am386SX/SXL micropro- 
cessor state. The EFLAGS register includes status and 
control bits that are used to reflect the outcome of many 
instructions and modify the semantics of some 
instructions. The Instruction Pointer (EIP) is 32-bits 
wide. The EIP controls instruction fetching, and the 
processor automatically increments it after executing an 
instruction. 


Control Registers: The four 32-bit control registers are 
used to control the global nature of the Am386SX/SXL 
microprocessor. The CRO register contains bits that set 
the different processor modes (Protected, Real, Paging, 
and Coprocessor Emulation). CR2 and CR3 registers 
are used in the paging operation. 
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EAX 
EBX 
ECX 
EDX 
ESI 

EDI 

EBP 
ESP 


CS 
SS 
DS 
ES 
FS 
GS 


EFLAGS 
EIP 


CRO 
Pt oe eee oe eee eee ORT 
Page Fault Linear Address Register CR2 


CR3 





! Page Directory Base Register 
47 16 15 0 


GDTR 


63 48 IDTR 
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TR 





DRO 
DR1 
DR2 
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DR4 
DR5 
DR6 
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Linear Breakpoint Address 0 
Linear Breakpoint Address 1 













Linear Breakpoint Address 2 
Linear Breakpoint Address 3 
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Reserved for future use—do not use. 
Figure 1. Am386SX/SXL Microprocessor Registers 
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System Address Registers: These four special regis- 
ters reference the tables or segments supported by 
the 80286/Am386SX/SXL/Am386DX/DXL CPU’s pro- 
tection model. These tables or segments are: 


GDTR (Global Descriptor Table Register), 
IDTR (interrupt Descriptor Table Register), 
LDTR (Local Descriptor Table Register), 
TR (Task State Segment Register). 


Debug Registers: The six programmer accessible de- 
bug registers provide on-chip support for debugging. 
The use of the debug registers is described in the sec- 
tion Debugging Support. 


Test Registers: Two registers are used to control the 
testing of the RAM/CAM (Content Addressable 
Memories) in the Translation Look-Aside Buffer portion 
of the Am386SX/SXL microprocessor. Their use is dis- 
cussed in the section Testability. 


EFLAGS Register 


The flag register is a 32-bit register named EFLAGS. 
The defined bits and bit fields within EFLAGS, shown in 
Figure 2, control certain operations and indicate the 
status of the Am386SX/SXL microprocessor. The lower 
16 bits (bits 15-0) of EFLAGS contain the 16-bit flag 
register named FLAGS. This is the default flag register 


Special Fields: 
I/O Privilege Level 


Nested Task 
17 16 15 4 13/12 
peb hs FE EEEEEEEL Esa 





used when executing 8086, 80286, or real mode code. 
The functions of the flag bits are given in Table 1. 


Control Registers 


The Am386SX/SXL microprocessor has three control 
registers of 32 bits, CR3—CRO, to hold the machine 


_ state of a global nature. These registers are shown in 


Figures 1 and 2. The defined CRO bits are described in 
Table 2. 


Instruction Set 


The instruction set is divided into nine categories of 
operations: 
Data Transfer 
Arithmetic — 
Shift/Rotate 
String Manipulation 
Bit Manipulation 
Control Transfer 
High-Level Language Support 
Operating System Support 
Processor Control 


These instructions are listed in the Instruction Set Clock 
Count Summary (pages 217 through 231). 


Status Flags: 
Overflow 


Sign 

Zero 

Aux Carry 
Parity 
Carry 





1110 9 7 46 5 


ee 


Control Flags: 
Trap 


Interrupt 
Direction 
Resume 
Virtual 8086 Mode 


Protection Enable 


Monitor Coprocessor 
Emulate Coprocessor 
Task Switched ana: 


Paging Enable 





MSW 


| 15022B-005 
Figure 2. Status and Control Register Bit Functions 
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Table 1. Flag Definitions 
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Sn genes att UO ae 
Carry Flag = on high- -order bit cary or borrow; cleared otherwise. 


Bit Position 


ae) 
4 


Parity Flag—Set if low-order 8 bits of result contain an even number of 1 bits; 
cleared otherwise. 


ae) 


Auxiliary Carry Flag—Set on ea from or borrow to the low-order 4 bits of 
AL; cleared otherwise. | 


> 
nN 


N 
~ 


Zero Flag—Set if result is zero; seaiee otherwise. 


ep) 
mal 


Sign Flag—Set equal t to high: -order bit of result (0 if cue 1 if negative). 


Single-Step Flag—Once set, a single-step interrupt occurs after the next 
instruction executes. TF is cleared by the single-step interrupt. 


Interrupt-Enable Flag—When set, maskable interrupts will cause the CPU to 
transfer control to an interrupt vector specified location. | 


Direction Flag—Causes ra wh instructions to auto-increment (default) the 
appropriate index registers when cleared. Setting DF causes auto-decrement. 


+ 
nm 











Overflow Flag—Set if the operation resulted in a carry/borrow into the sign bit 
(high-order bit) of the result but did not result in a carry/borrow out of the high- | 
order bit or vice- versa. | 





O 
nN 









I/O Privilege Leval—Iindicates the maximum CPL permitted to execute I/O 
instructions without generating an Exception 13 fault or consulting the I/O 
permission bit map while executing in protected mode. For virtual 8086 mode 
it indicates the maximum CPL allowing alteration of the IF bit. 


Nested Task—Indicates that the execution of the current task is nested within 
another task. = | 


Resume Flag—Used in conjunction with debug register breakpoints. It is 
checked at instruction boundaries before breakpoint processing. If set, any 
debug fault is ignored on the next instruction. 






12,13 IOPL 






™~ 
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Zz 
= 





me) 
a 









Virtual 8086 Mode—lf set while in protected mode, the Am386SXL micro- 
processor will switch to virtual 8086 operation, handling segment loads as 
8086 does, but generating Exception 13 faults on privileged op-codes. 


< 





Table 2. CRO Definitions 


Bit Position 


Protection Mode Enable—Places the Am386SXL microprocessor into pro- 
tected mode. If PE is reset, the processor operates again in Real Mode. PE 
may be set by loading MSW or CRO. PE can be reset only by loading CRO; 
it cannot be reset by the LMSW instruction. 


Monitor Coprocessor Extension—Allows WAIT instructions to cause a 
processor extension Not Present exception (number 7). 


Emulate Processor Extension—Causes a processor extension Not Present 
exception (number 7) on ESC instructions to allow emulating a processor 
extension. ' | 


Task Switched—tIndicates the next instruction using a processor extension will 
cause Exception 7, allowing software to test whether the current processor 
extension context belongs to the current task. 


Paging Enable Bit—is set to enable the on-chip paging unit. It is reset to 
disable the on-chip paging unit. 
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All Am386SX/SXL microprocessor instructions operate 
on either 0, 1, 2, or 3 operands; an operand resides ina 
register, in the instruction itself, or in memory. Most zero 
operand instructions (e.g., CLI, STI) take only one byte. 
One operand instruction generally is two bytes long. The 
average instruction is 3.2-bytes long. Since the 
Am386SX/SXL CPU has a 16-byte prefetch instruction 
queue, an average of 5 instructions will be prefetched. 
The use of two operands permits the following types of 
common instructions: 

Register to Register 

Memory to Register 

Immediate to Register 

Memory to Memory 

Register to Memory 

immediate to Memory 
The operands can be either 8, 16, or 32 bits long. As a 
general rule, when executing code written for the 
Am386SX/SXL microprocessor (32-bit code), operands 
are 8 or 32 bits; when executing existing 8086 or 80286 
code (16-bit code), operands are 8 or 16 bits. Prefixes 
can be added to all instructions which override the 
default length of the operands (i.e., use 32-bit operands 
for 16-bit code, or 16-bit operands for 32-bit code). 


Effective Address Calculation 


index 


Scale 
1,2,4,8 


32 


Effective Address 


15 2 0 


Logical or 


R Unit 
Virtual Address 
Selector P 114 


Eire Descriptor 
' Segment Register Index 


Segmentation 





Memory Organization 


Memory on the Am386SX/SXL microprocessor is 
divided into 8-bit quantities (Bytes), 16-bit quantities 
(Words), and 32-bit quantities (Dwords). Words are 
stored in two consecutive bytes in memory with the 
low-order byte at the lowest address. Dwords are stored 
in four consecutive bytes in memory with the low-order 
byte at the lowest address. The address of a Word or 
Dword is the byte address of the low-order byte. 


In addition to these basic data types, the AmM386SX/SXL 
microprocessor supports two larger units of memory: 
pages and segments. Memory can be divided up into 
one or more variable length segments, which can be 
swapped to disk or shared between programs. Memory 
can also be organized into one or more 4-Kb pages. 
Finally, both segmentation and paging can be 
combined, gaining the advantages of both systems. 
The Am386SX/SXL CPU supports both pages and 
segmentation in order to provide maximum flexibility to 
the system designer. Segmentation and paging are 
complementary. Segmentation is useful for organizing 
memory in logical modules, and, as such, is atool forthe 
application programmer, while pages are useful to the 
system programmer for managing the physical memory 
of a system. 





BHE-BLE 
A23-A1 
Physical 
Memory 
32 Paging Unit 24 
(Optional Use) 
Linear Physical 
Address Address 
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Figure 3. Address Translation 
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Address Spaces 


The Am386SX/SXL microprocessor has three types of 
address spaces: logical, linear, and physical. A logical 
address (also known as a virtual address) consists of a 
selector and an offset. A selector is the contents of a 
segment register. An offset is formed by summing all of 
the addressing components (Base, Index, Displace- 
ment) discussed in the section Addressing Modes, into 
an effective address. This effective address, along with 
the selector, is known as the logical address. Since each 
task onthe Am386SX/SXL CPU has a maximum of 16K 
(2'4-1) selectors, and offsets can be 4 Gb (with paging 
enabled), this gives a total of 2*° bits, or 64 tb, of logical 
address space per task. The programmer sees the 
logical address space. 


The segmentation unit translates the logical address 
space into a 32-bit linear address space. If the paging 
unit is not enabled then the 32-bit linear address is 
truncated into a 24-bit physical address. The physical 
address is what appears on the address pins. 


The primary differences between Real Mode and 
Protected Mode are how the segmentation unit 
performs the translation of the logical address into the 
linear address, size of the address space, and paging 
capability. In Real Mode, the segmentation unit shifts 
the selector left four bits and adds the result to the 
effective address to form the linear address. This linear 
address is limited to 1 Mb. In addition, Real Mode has 
no paging capability. 


Protected Mode will see one of two different address 
spaces, depending on whether or not paging is enabled. 
Every selector has a logical base address associated 
with it that can be up to 32 bits in length. This 32-bit 
logical base address is added to the effective address to 
form a final 32-bit linear address. If paging is disabled, 
this final linear address reflects physical memory and is 
truncated so that only the lower 24 bits of this address 
are used to address the 16-Mb memory address space. 
If paging is enabled, this final linear address reflects a 
32-bit address that is translated through the paging unit 
to form a 16-Mb physical address. The logical base 
address is stored in one of two operating system tables 
(i.e., the Local Descriptor Table or Global Descriptor 
Table). 


Figure 3 shows the relationship between the various 
address spaces. 


Segment Register Usage 


The main data structure used to organize memory is the 
segment. On the Am386SX/SXL CPU, segments are 
variable sized blocks of linear addresses which have 
certain attributes associated with them. There are two 
main types of segments, code and data. The segments 
are of variable size and can be as small as 1 byte or as 
large as 4 Gb (2 bits). 


In order to provide compact instruction encoding and 
increase processor performance, instructions do not 
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need to explicitly specify which segment register is 
used. The segment register is automatically chosen 
according to the rules of Table 3 (Segment Register 
Selection Rules). In general, data references use the 
selector contained in the DS register; stack references 
use the SS register; and, instruction fetches use the CS 
register. The contents of the Instruction Pointer provide 
the offset. Special segment override prefixes allow the 
explicit use of a given segment register and override the 
implicit rules listed in Table 3. The override prefixes also 
allow the use of the ES, FS, and GS segment registers. 


There are no restrictions regarding the overlapping of 
the base addresses of any segments. Thus, all six 
segments could have the base address set to zero and 
create a system with 4-Gb linear address space. 
This creates a system where the virtual address space 
is the same as the linear address space. Further details 
of segmentation are discussed in the section Protected 
Mode Architecture. 


Addressing Modes 


The Am386SX/SXL microprocessor provides a total of 
eight addressing modes for instructions to specify 
operands. The addressing modes are optimized to allow 
the efficient execution of high-level languages suchas C 
and FORTRAN, and they coverthe vast majority of data 
references needed by high-level languages. 


Register and Immediate Modes 


Two of the addressing modes provide for instructions 
that operate on register or immediate operands. 


Register Operand Mode: The operand is located in 
one of the 8-, 16-, or 32-bit general registers. 


immediate Operand Mode: The operand is included in 
the instruction as part of the op-code. 


32-Bit Memory Addressing Modes 


The remaining six modes provide a mechanism for 
specifying the effective address of an operand. The 
linear address consists of two components: the seg- 
ment base address and an effective address. The 
effective address is calculated by summing any com- 
bination of the following three address elements (see 
Figure 3). 


Displacement: an 8-,16-, or 32-bit immediate value, 
following the instruction. 


Base: The contents of any general purpose register. 
The base registers are generally used by compilers to 
point to the start of the local variable area. 


Index: The contents of any general purpose register 
except for ESP. The index registers are used to access 
the elements of an array or a string of characters. The 
index register’s value can be multiplied by a scale factor, 
either 1, 2, 4, or 8. The scaled index is especially useful 
for accessing arrays or structures. 
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Table 3. Segment Register Selection Rules 


Type of Memory Reference implied (Default) Segment Use | Segment Override Prefixes Possible 


Code Fetch 


Destination of PUSH, PUSHF, INT, | 
CALL, PUSHA Instructions 


Source of POP, POPA, POPF, 
IRET, RET Instructions 


Destination of STOS, MOVE, REP 
STOS, REP MOVS Instructions 


Other Data References, with 


Effective Address Using Base 
Register of: 


[EAX] 
[EBX] 
[ECX] 
[EDX] 
[esi] 

[EDI] 

[EBP] 
[ESP] 


Combinations of these three components make up the 
six additional addressing modes. There is no perform- 
ance penalty for using any of these addressing 
combinations, since the effective address calculation is 
pipelined with the execution of other instructions. The 
one exception is the simultaneous use of Base and 
Index components which requires one additional clock. 


As shown in Figure 4, the Effective Address (EA) of 
an operand is calculated according to the following 
formula: 


EA = Baseénegister + (INdexRegister x Scaling) + Displacement 


1. Direct Mode: The operand’s offset is contained as 
part of the instruction as an 8-, 16-, or 32-bit 
displacement. 


2. Register Indirect Mode: A Base register contains 
the address of the operand. 


3. Based Mode: A Base register’s contents are added 
to a Displacement to form the operand’s offset. 


4. Scaled Index Mode: An Index register’s contents 
are multiplied by a Scaling factor, and the result is 
added to a Displacement to form the operand’s 
offset. 


5. Based Scaled Index Mode: The contents of an 
Index register are multiplied by a Scaling factor, and 
the result is added to the contents of a Base register 
to obtain the operand’s offset. 


6. Based Scaled Index Mode with Displacement: 
The contents of an Index register are multiplied by a 
Scaling factor, and the result is added to the contents 
of a Base register and a Displacement to form the 
operand’s offset. 


CS, SS, ES, FS, GS 
CS, SS, ES, FS, GS 
CS, SS, ES, FS, GS 
CS, SS, ES, FS, GS 
CS, SS, ES, FS, GS 
CS, SS, ES, FS, GS 
CS, DS, ES, FS, GS 
CS, DS, ES, FS, GS 





Differences Between 16- and 32-Bit Addresses 


In order to provide software compatibility with the 8086 
and the 80286, the Am386SX/SXL microprocessor can 
execute 16-bit instructions in Real and Protected 
Modes. The processor determines the size of the 
instructions it is executing by examining the D bit ina 
Segment Descriptor. If the D bit is 0, then all operand 
lengths and effective addresses are assumed to be 
16-bits long. If the D bit is 1, then the default length for 
operands and addresses is 32 bits. In Real Mode the 
default size for operands and addresses is 16 bits. 


Regardless of the default precision of the operands or 
addresses, the Am386SX/SXL microprocessor is able 
to execute either 16- or 32-bit instructions. This is 
specified through the use of override prefixes. Two 
prefixes, the Operand Length Prefix and the Address 
Length Prefix, override the value of the D bit on an 
individual instruction basis. These prefixes are 
automatically added by assemblers. 


The Operand Length and Address Length Prefixes can 
be applied separately or in combination to any 
instruction. The Address Length Prefix does not allow 
addresses over 64 Kb to be accessed in Real Mode. 
A memory address which exceeds OFFFFH will result 
in a General Protection Fault. An Address Length Prefix 
only allows the use of the additional Am386SX/SXL 
CPU addressing modes. 


When executing 32-bit code, the Am386SX/SXL CPU 
uses either 8- or 32-bit displacements, and any register 
can be used as Base or Index registers. When executing 
16-bit code, the displacements are either 8- or 16-bits, 
and the Base and Index registers conform to the 
80286 model. Table 4 illustrates the differences. 
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Figure 4. Addressing Mode Caiculations 


Data Types 

The Am386SX/SXL microprocessor supports all of the 
data types commonly used in high-level languages. 
Bit: A single bit quantity. 


Bit Field: A group of up to 32 contiguous bits, which 
spans a maximum of four bytes. 


Bit String: A set of contiguous bits; on the Am386SX/ 
SXL microprocessor, bit strings can be up to 4 Gbits 
long. 


Byte: A signed 8-bit quantity. 
Unsigned Byte: An unsigned 8-bit quantity. 
Integer (Word): A signed 16-bit quantity. 


Long Integer (Dword): A signed 32-bit quantity. All 
operations assume a 2’s complement representation. 


Unsigned Integer (Word): An unsigned 16-bit quantity. 


. Unsigned Long Integer (Dword): An unsigned 32-bit 
quantity. 


Signed Quad Word: A signed 64-bit quantity. 


Unsigned Quad Word: An unsigned 64-bit quantity. 


Pointer: A 16- or 32-bit offset-only quantity which 
indirectly references another memory location. 


Long Pointer: A full pointer which consists of a 16-bit 
segment selector and either a 16- or 32-bit offset. 


Char: A byte representation of an ASCII alphanumeric 


or control character. 


String: A contiguous sequence of bytes, Words, or 
Dwords. A string may contain between 1 byte and 4 Gb. 


BCD: A byte (unpacked) representation of decimal 
digits 0-9. 

Packed BCD: A byte (packed) representation of two 
decimal digits 0-9 storing one digit in each nibble. 


When the Am386SX/SXL microprocessor is coupled 
with a 387SX math coprocessor, the following common 
floating point types are supported. 


Floating Point: A signed 32-, 64-, or 80-bit real number 
representation. Floating point numbers are supported 
by 387SX-compatible math coprocessors. 
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Table 4. Base and Index Registers for 16- and 


or not restart of the instruction causing the exception is 


32-Bit Addresses 


| 16-Bit 32-Bit | 
mee Addressing Addressing 


Base Register | BX, BP Any 32-bit GP Register 
Index Register| Sj, DI Any 32-bit GP Register| 
Except ESP 






























None 
0, 8, 16 bits 


Scale Factor 
Displacement 


1,2, 4,8 
0, 8, 32 bits 


Figure 5 illustrates the data types supported by 
the Am386SX/SXL microprocessor and a 387SX- 
compatible math coprocessor. 


I/O Space 


The Am3886SX/SXL CPU has two distinct physical 
address spaces: physical memory and I/O. Generally, 
peripherals are placed in I/O space, although the 
Am386SX/SXL CPU also supports memory-mapped 
peripherals. The I/O space consists of 64 Kb which can 
be divided into 64K 8-bit ports or 32K 16-bit ports, or any 
combination of ports which add up to no more than 
64 Kb. The 64Kb I/O address space refers to physical 
addresses rather than linear addresses since 1/O 
instructions do not go through the segmentation or 
paging hardware. The M/IO pin acts as an additional 
address line, thus allowing the system designer to easily 
determine which address space the processor is 
accessing. 


The I/O ports are accessed by the In and Out 
instructions, with the port address supplied as an 
immediate 8-bit constant in the instruction or in the DX 
register. All 8-bit and 16-bit port addresses are zero 
extended on the upper address lines. The I/O 
instructions cause the M/IO pin to be driven Low. I/O 
port addresses 0OF8H through OOFFH are reserved for 
future use. 


Interrupts and Exceptions 


Interrupts and exceptions alter the normal program 
flow in order to handle external events, report errors, 


or report exceptional conditions. The difference be- 
tween interrupts and exceptions is that interrupts are 


used to handle asynchronous external events while 
exceptions handle instruction faults. Although a pro- 
gram can generate a software interrupt via an INT n 
instruction, the processor treats software interrupts as 
exceptions. 


Hardware interrupts occur as the result of an external 
event and are classified into two types: maskable 
or non-maskable. Interrupts are serviced after the 
execution of the current instruction. After the interrupt 
handler is finished servicing the interrupt, execution 
proceeds with the instruction immediately after the 
interrupted instruction. 


Exceptions are classified as faults, traps, or aborts, 
depending on the way they are reported and whether 


supported. Faults are exceptions that are detected and 
serviced before the execution of the faulting instruction. 
Traps are exceptions that are reported immediately 
after the execution of the instruction which caused the 
problem. Aborts are exceptions that do not permit the 
precise location of the instruction causing the exception 
to be determined. 


Thus, when an interrupt service routine has been 
completed, execution proceeds from the instruction 
immediately following the interrupted instruction. Onthe 
other hand, the return address from an exception fault 
routine will always point to the instruction causing the 
exception and will include any leading instruction 
prefixes. Table 5 summarizes the possible interrupts for 
the Am386SX/SXL microprocessor and shows where 
the return address points. 


The Am3886SX/SXL CPU has the ability to handle up to 
256 different interrupts/exceptions. In order to service 
the interrupts, a table with up to 256 interrupt vectors 
must be defined. The interrupt vectors are simply 
pointers to the appropriate interrupt service routine. In 
Real Mode, the vectors are 4-byte quantities, a Code 
Segment plus a 16-bit offset; in Protected Mode, 
the interrupt vectors are 8-byte quantities which are 
put in an Interrupt Descriptor Table. Of the 256 possible 
interrupts, 32 are reserved for future use and the re- 
maining 224 are free to be used by the system designer. 


Interrupt Processing 


When an interrupt occurs, the following actions happen. 
First, the current program address and Flags are saved 
on the stack to allow resumption of the interrupted 
program. Next, an 8-bit vector is supplied to the 
Am386SX/SXL microprocessor which identifies the ap- 
propriate entry in the interrupt table. The table contains 
the starting address of the interrupt service routine. 
Then, the user supplied interrupt service routine is 
executed. Finally, when an IRET instruction is executed 
the old processor state is restored and program 
execution resumes at the appropriate instruction. 


The 8-bit interrupt vector is supplied to the Am386SX/ 
SXL microprocessor in several different ways: excep- 
tions supply the interrupt vector internally; software INT 
instructions contain or imply the vector; maskable 
hardware interrupts supply the 8-bit vector via the 
interrupt acknowledge bus sequence. Non-Maskable 
hardware interrupts are assigned to interrupt vector 2. 


Maskable Interrupt 


Maskable interrupts are the most common way to 
respond to asynchronous external hardware events. A 
hardware interrupt occurs when the INTR is pulled High 
and the Interrupt Flag bit (IF) is enabled. The processor 
only responds to interrupts between instructions (string 
instructions have an interrupt window between mem- 


ory moves that allows interrupts during long string 
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Figure 5. Am386SX/SXL Microprocessor Supported Data Types 
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Table 5. Interrupt Vector Assignments 


Interrupt Instruction Which Return Address Points 
Number Can Cause Exception to Faulting Instruction Type 






Function 









Divide Error 


DIV, IDIV 


Debug Exception | 
NMI Interrupt 
One Byte Interrupt 


b 

aaa 
pete 
Pe 
a 
= [Ne 


Interrupt on Overflow 
Array Bounds Check 
Invalid Op-code 

Device Not Available 


6 Any Illegal Instruction 
ESC, WAIT 


. . 


Any instruction that can generate an 


° 


exception 


Coprocessor Segment Overrun | ABORT | 
invalid TSS | tM, CALLIRETINT | Ves FAULT _ 
|SegmentNot Present___|_11_| Segment Register Instructions | Ves, | FAULT 
[StackFaut | 12 | Stack References | Yes | FAULT 


Double Fault 






Reserved for Future Use 
Two Byte Interrupt 







ESC, WAIT 
Le eee sen 







Note: Some debug exceptions may report both traps on the previous instruction and faults on the next instruction. 


moves). When an interrupt occurs the processor reads 
an 8-bit vector supplied by the hardware which identifies 
the source of the interrupt (one of 224 user defined 
interrupts). 


Interrupts through interrupt gates automatically reset IF 
bit, disabling INTR requests. Interrupts through Trap 
Gates leave the state of the IF bit unchanged. Interrupts 
through a Task Gate change the IF bit according to the 
image of the EFLAGs register in the task’s Task State 
Segment (TSS). When an IRET instruction is executed, 
the original state of the IF bit is restored. 


Non-Maskable Interrupt 


Non-maskable interrupts provide a method of servicing 
very high priority interrupts. When the NMI input is 
pulled High it causes an interrupt with an internally 
supplied vector value of 2. Unlike a normal hardware 
interrupt, no interrupt acknowledgment sequence is 
performed for an NMI. 


While executing the NMI servicing procedure, the 
Am8386SX/SXL microprocessor will not service any fur- 
ther NMI request or INT requests until an Interrupt Re- 
turn (IRET) instruction is executed or the processor is 
reset. If NMI occurs while currently servicing an NMI, its 
presence will be saved for servicing after executing the 
first IRET instruction. The IF bit is cleared at the begin- 
ning of an NMI interrupt to inhibit further INTR interrupts. 


Software Interrupts 


A third type of interrupt/exception for the Am386SX/SXL 
CPU is the software interrupt. An INT n instruction 


causes the processor to execute the interrupt service 
routine pointed to by the nth vector in the interrupt table. 


A special case of the two byte software interrupt INT nis 
the one byte INT 3, or breakpoint interrupt. By inserting 
this one byte instruction in a program, the user can set 
breakpoints in his program as a debugging tool. 


A final type of software interrupt is the single-step 
interrupt. It is discussed in section Single-Step Trap. 


Interrupt and Exception Priorities 


Interrupts are externally generated events. Mask- 
able Interrupts (on the INTR input) and Non-Maskable 
Interrupts (on the NMI input) are recognized at instruc- 
tion boundaries. When NMI and maskable INTR are 
both recognized at the same instruction boundary, the 
Am386SX/SXL_ microprocessor invokes the NMI 
service routine first. If maskable interrupts are still 
enabled after the NMI service routine has been invoked, 
then the Am3886SX/SXL CPU willinvoke the appropriate 
interrupt service routine. 


As the Am386SX/SXL microprocessor executes in- 
structions, it follows a consistent cycle in checking for 
exceptions, as shown in Table 6. This cycle is repeated 
as each instruction is executed, and occurs in parallel 
with instruction decoding and execution. 


Instruction Restart 


The Am386SX/SXL microprocessor fully supports re- 
starting all instructions after Faults. If an exception is 
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detected in the instruction to be executed (exception 
categories 4 through 10 in Table 6), the Am386SX/SXL 
microprocessor invokes the appropriate exception 
service routine. The Am386SX/SXL microprocessor is 
in a state that permits restart of the instruction, for all 
cases by those given in Table 7. Note that all such 
cases will be avoided by a properly designed operating 
system. 


Double Fault 


A Double Fault (Exception 8) results when the 
processor attempts to invoke an exception service 
routine for the segment exceptions (10, 11, 12, or 13), 
but in the process of doing so detects an exception other 
than a Page Fault (Exception 14). 


One other cause of generating a Double Fault is the 
Am386SX/SXL CPU detecting any other exception 
when it is attempting to invoke the Page Fault (Excep- 
tion 14) service routine (e.g., if a Page Fault is detected 
when the Am386SX/SXL microprocessor attempts to in- 
voke the Page Fault service routine). Of course, in any 
functional system, not only the Am386SX/SXL CPU- 
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based systems, the entire Page Fault service must 
remain present in memory. 


Reset and Initialization 


When the processor is initialized or Reset, the registers 
have the values shown in Table 8. The Am386SX/SXL 
CPU will then start executing instructions near the 
top of physical memory, at location OFFFFFOH. When 
the first intersegment Jump or Call is executed, address 
lines A23—A20 will drop Low for CS-relative memory 
cycles, and the Am386SX/SXL CPU will only execute 
instructions in the lower 1 Mb of physical memory. This 
allows the system designer to use a Shadow ROM atthe 
top of physical memory to initialize the system and take 
care of Resets. 


Reset forces the Am386SX/SXL microprocessor to 
terminate all execution and local bus activity. No 
instruction execution or bus activity will occur as long as 
Reset is active. Between 350- and 450-CLK2 periods 
after Reset becomes inactive, the AM386SX/SXL mi- 
croprocessor will start executing instructions at the top 
of physical memory. 


Table 6. Sequence of Exception Checking 


Consider the case of the Am386SXL microprocessor having just completed an instruction. It then performs the following checks 


before reaching the point where the next instruction is completed. 


1. Check for Exception 1 Traps from the instruction just completed (single-step via Trap Flag, or Data Breakpoints set in the 


Debug Registers). 
2. Check for external NMI! and INTR. 


3. Check for Exception 1 Faults in the next instruction (Instruction Execution Breakpoint set in the Debug Registers for the next 


instruction). 


4. Check for Segmentation Faults that prevented fetching the entire next instruction (Exceptions 11 and 13). 


a! 


Check for Page Faults that prevented fetching the entire next instruction (Exception 14). 


6. Check for Faults decoding the next instruction (Exception 6 if illegal op-code; Exception 6 if in Real Mode or in Virtual 8086 
Mode and attempting to execute an instruction for Protected Mode only; or Exception 13 if instruction is longer than 15 bytes, or 
privilege violation in Protected Mode (i.e., not at IOPL or at CPL=0)). 


7. If WAIT op-code, check if TS =1 and MP =1(Exception 7 if both are 1). 


ag 


lf ESCape op-code for math coprocessor, check if EM=1 or TS=1 (Exception 7 if either are 1). 


9. If WAIT op-code or ESCape op-code for math coprocessor, check ERROR input signal (Exception 16 if ERROR input is 


asserted). 


10. Check in the following order for each memory reference required by the instruction. 


a. Check for Segmentation Faults that prevent transferring the entire memory quantity (Exceptions 11, 12, and 13). 
b. Check for Page Faults that prevent transferring the entire memory quantity (Exception 14). 


Note: Segmentation exceptions are generated before paging exceptions. 


Table 7. Conditions Preventing Instruction Restart 


. Aninstruction causes a task switch to a task whose Task State Segment (TSS) is partially not present (an entire not present 


TSS is restartable). Partially present TSSs can be avoided either by keeping the TSSs of such tasks present in memory, or by 
aligning TSS segments to reside entirely within a single 4K page (for TSS segments of 4 Kb or less). 


A coprocessor operand wraps around the top of a 64-Kb segment or a 4-Gb segment and spans three pages, and the page 
holding the middle portion of the operand is not present. This condition can be avoided by starting at a page boundary any 
segments containing coprocessor operands, if the segments are approximately 64K—200K bytes or larger (i.e., large enough 
for wraparound of the coprocessor operand to possibly occur). 


Note: These conditions are avoided by using the operating system designs mentioned in this table. 
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_ Flag Word (EFLAGS) 
Machine Status Word (CRO) 
Instruction Pointer (EIP) 
Code Segment (CS) 

Data Segment (DS) 
Stack Segment (SS) 


Extra Segment (ES) 
Extra Segment (FS) 
Extra Segment (GS) 
EAX Register 

EDX Register 

All Other Registers 


Notes: 


the part. 


An ROMS 


EDX register always holds a component and stepping identifier. 
All undefined bits are reserved for future use and should not be used. 


Table 8. Register Values after Reset 


uuuu0002H 

uuuuuu1 OH 

OOOOFFFOH 
FOOOH 
0000H 
0O00H 
0000H 
OOOOH 
0000H 


0000H 


Component and Stepping ID 


Undefined | 


. EFLAGS Register. The upper 14 bits of the EFLAGS register are undefined; all defined flag bits are zero. 
The Code Segment register (CS) will have its Base Address set to OFFFFOOOOH and Limit set to OFFFFH. 
The Data and Extra Segment registers (DS and ES) will have their Base Address set to OOOOOOO000H and Limit set to OFFFFH. 
If self-test is selected, the EAX register should contain a 0 value. If a value of 0 is not found, the self-test has detected a flaw in 





Testability 


The Am386SX/SXL microprocessor, like the AmM386DX/ 
DXL microprocessor, offers testability features that in- 
clude a self-test and direct access to the page 
translation cache. 


Self-Test 


The Am386SX/SXL microprocessor has the capability 
to perform a self-test. The self-test checks the function 
of all of the Control ROM and most of the non-random 
logic of the part. Approximately one-half of the 
Am386SX/SXL CPU can be tested during self-test. 


Self-Test is initiated on the Am386SX/SXL micropro- 
cessor when the Reset pin transitions from High to Low, 
and the BUSY pin is Low. The self-test takes about 27° 
clocks, or approximately 33 ms with a 16-MHz 
Am386SX/SXL CPU. At the completion of self-test the 
processor performs reset and begins normal operation. 
The part has successfully passed self-test if the 
contents of the EAX are zero. If the results of the EAX 
are not zero, then the self-test has detected a flaw in 
the part. 


TLB Testing 


The Am886SX/SXL microprocessor also provides a 
mechanism for testing the Translation Look-Aside 
Buffer (TLB), if desired. This particular mechanism may 
not be continued in the same way in future processors. 


There are two TLB testing operations: 1) writing entries 
into the TLB; and, 2) performing TLB lookups. Two test 
registers, shown in Figure 6 are provided for the 
purpose of testing. TR6 is the test command register, 
and TR7 is the test data register. 





Debugging Support 


The Am386SX/SXL microprocessor provides several 
features which simplify the debugging process. The 
three categories of on-chip debugging aids are: 


1. The code execution breakpoint op-code (OCCH). 


2. The single-step capability provided by the TF bit in 
the flag register. 


3. The code and data breakpoint capability provided by 
the Debug Registers DR3—DRO, DR6, and DR7. 


Breakpoint Instruction 


A single-byte software interrupt (INT 3) breakpoint 
instruction is available for use by software debuggers. 
The breakpoint op-code is OCCH, and generates an 
Exception 3 trap when executed. 


Single-Step Trap 


If the single-step flag (TF, bit 8) in the EFLAGS register 
is found to be set at the end of an instruction, a 
single-step exception occurs. The single-step exception 
is auto-vectored to Exception 1. 


Debug Registers 


The Debug Registers are an advanced debugging 
feature of the Am386SX/SXL microprocessor. They 
allow data access breakpoints as well as code 
execution breakpoints. Since the breakpoints are 
indicated by on-chip registers, an instruction execution 
breakpoint can be placed in ROM code or in code 
shared by several tasks, neither of which can be 
supported by the INT 3 breakpoint op-code. 


The Am386SX/SXL microprocessor contains six De- 
bug Registers, consisting of four breakpoint address 
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Table 9. Exceptions in Real Mode 


Interrupt Related Return 
Number Instructions Address Location 


Interrupt table limit too small 


CS, DS, ES, FS, GS 
Segment Overrun exception 


INT vector is not within table limit 


Word memory reference with 
offset = OFFFFH. An attempt to 


Before 
Instruction 


Before 
Instruction 


execute past the end of CS segment. 


SS Segment Overrun exception 


Command 
Writable 
User 

Dirty 


Valid | 






Reserved for future use — do not use. 


Stack Reference 
beyond offset = OFFFFH. 





31 12 


Before 
Instruction 


Test 
Control 






rate Tv [Jo] ZZ] 
1211 10 70 

Test 

Status 


15022B—006 


Figure 6. Test Registers 


registers and two breakpoint control registers. Initially 
after reset, breakpoints are in the disabled state; 
therefore, no breakpoints will occur unless the Debug 
Registers are programmed. Breakpoints set up in the 
Debug Registers are auto-vectored to Exception 1. 
Figure 7 shows the breakpoint status and control 
registers. 


REAL MODE ARCHITECTURE 


When the processor is reset or powered up it is 
initialized in Real Mode. Real Mode has the same base 
architecture as the 8086, but allows access to the 32-bit 
register set of the Am386SX/SXL microprocessor. The 
addressing mechanism, memory size, and interrupt 
handling are all identical to the Real Mode onthe 80286. 


The default operand size in Real Mode is 16 bits, as in 
the 8086. In order to use the 32-bit registers and 
addressing modes, override prefixes must be used. In 
addition, the segment size on the Am386SX/SXL micro- 
processor in Real Mode is 64 Kb, so 32-bit addresses 
must have a value less than OOOOFFFFH. The primary 
purpose of Real Mode is to set up the processor for 
Protected Mode operation. 


Memory Addressing 


In Real Mode the linear addresses are the same as 
physical addresses (paging is not allowed). Physical 
addresses are formed in Real Mode by adding the 
contents of the appropriate segment register which is 
shifted left by four bits to an effective address. This 
addition results in a 20-bit physical address or a 1-Mb 
address space. Since segment registers are shifted left 
by 4 bits, Real Mode segments always start on 16-byte 
boundaries. 


All segments in Real Mode are exactly 64-Kb long, and 
may be read, written, or executed. The AmM386SX/SXL 
microprocessor will generate an Exception 13 if a data 
operand or instruction fetch occurs past the end of a 
segment. 


Reserved Locations 


There are two fixed areas in memory that are reserved 
in Real Address Mode: the system initialization area 
and the interrupt table area. Locations 00000H through 
OO3FFH are reserved for interrupt vectors. Each 
one of the 256 possible interrupts has a 4-byte jump 





Am386SX/SXL Microprocessor Data Sheet 163 














al AMD 





vector reserved for it. Locations OFFFFFOH through 
OFFFFFFH are reserved for system initialization. 


interrupts 


Many of the exceptions discussed in section Interrupts 
and Exceptions are not applicable to Real Mode 
operation; in particular, Exceptions 10, 11, and 14 do 
not occur in Real Mode. Other exceptions have slightly 
different meanings in Real Mode; Table 9 identifies 
these exceptions. 


Shutdown and Halt 


The HLT instruction stops program execution and 
prevents the processor from using the local bus until 
restarted. Either NMI, FLT, INTR with interrupts enabled 
(IF=1), or Reset will force the Am386SX/SXL micropro- 
cessor out of halt. If interrupted, the saved CS:IP will 
point to the next instruction after the HLT. 


Shutdown will occur when a severe error is detected 
that prevents further processing. In Real Mode, shut- 
down can occur under two conditions: 


1. An interrupt or an exception occurs (Exceptions 8 or 
13) and the interrupt vector is larger than the 
Interrupt Descriptor Table. 


2. A Call, INT, or Push instruction attempts to wrap 
around the stack segment when SP is not even. 


An NMI input can bring the processor out of shutdown if 
the Interrupt Descriptor Table limit is large enough to 
contain the NMI interrupt vector (at least OOOFH) andthe 
stack has enough room to contain the vector and flag in- 
formation (i.e., SP is greater than 0005H). Otherwise, 
shutdown can only be exited by a processor reset. 


LOCK Operation 


The LOCK prefix on the Am386SX/SXL microproces- 
sor, even in Real Mode, is more restrictive than on the 
80286. This is due to the addition of paging on the 
Am386SX/SXL CPU in Protected Mode and Virtual 
8086 Mode. The LOCK prefix is not supported during re- 
peat string instructions. 


The only instruction forms where the LOCK prefix is 
legal on the Am386SX/SXL microprocessor are shown 
in Table 10. 


Table 10. Legal Instructions for the LOCK Prefix 


| Operands 
Op-Code (Dest, Source) 


BIT Test and Mem, Reg/Immed 



















SET/RESET/COMPLEMENT 
XCHG Reg, Mem 
XCHG Mem, Reg 
ADD, OR, ADC, SBB Mem, Reg/Immed 
! AND, SUB, XOR 








| NOT, NEG, INC, DEC Mem 


An Exception 6 will be generated if a LOCK prefix is 
placed before any instruction form or op-code not listed 
above. The LOCK prefix allows indivisible read/modify/ 
write operations on memory operands using the instruc- 
tions above. 


The LOCK prefix is not IOPL-sensitive on the 
Am386SX/SXL microprocessor. The LOCK prefix can 
be used at any privilege level, but only on the instruction 
forms listed in Table 10. 


PROTECTED MODE ARCHITECTURE 


The complete capabilities of the Am386SX/SXL micro- 
processor are unlocked when the processor operates in 
Protected Virtual Address Mode (Protected Mode). 
Protected Mode vastly increases the linear address 
space to 4 Gb (2 bytes), and allows the running of 
virtual memory programs of almost unlimited size (64 tb 
(2*© bytes)). In addition, Protected Mode allows the 
Am386SX/SXL CPU to run all of the existing AmM386DX/ 
DXL CPU (using only 16 Mb of physical memory), 
80286, and 8086 CPU’s software, while providing a 
sophisticated memory management and a hardware- 
assisted protection mechanism. Protected Mode allows 
the use of additional instructions specially optimized for 
supporting multitasking operating systems. The base 
architecture of the Am3886SX/SXL microprocessor 
remains the same; the registers, instructions, and 
addressing modes described in the previous sections 
are retained. The main difference between Protected 
Mode and Real Mode from a programmer’s viewpoint is 
the increased address space and a different addressing 
mechanism. 


Addressing Mechanism 


Like Real Mode, Protected Mode uses two components 
to form the logical address: a 16-bit selector is used to 
determine the linear base address of a segment, the 
base address is added to a 32-bit effective address to 
form a 32-bit linear address. The linear address is then 
either used as a 24-bit physical address, or if paging is 
enabled, the paging mechanism maps the 32-bit linear 
address into a 24-bit physical address. 


The difference between the two modes lies in 
calculating the base address. In Protected Mode, the 
selector is used to specify an index into an operating 
system defined table (see Figure 8). The table contains 
the 32-bit base address of a given segment. The 
physical address is formed by adding the base address 
obtained from the table to the offset. 


Paging provides an additional memory management 
mechanism which operates only in Protected Mode. 
Paging provides a means of managing the very large 
segments of the Am386SX/SXL microprocessor, as 
paging operates beneath segmentation. The page 
mechanism translates the protected linear address 
which comes from the segmentation unit into a physical 
address. Figure 9 shows the complete Am386SX/SXL 
CPU addressing mechanism with paging enabled. 
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Figure 7. Debug Registers 


Segmentation 


Segmentation is one method of memory management. 
It provides the basis for software protection and is used 
to encapsulate regions of memory that have common 
attributes. For example, all of the code of a given 
program could be contained in a segment, or an 
operating system table may reside in a segment. All 
information about each segment is stored in an 8-byte 
data structure called a descriptor. All of the descriptors 
ina system are contained in descriptor tables which are 
recognized by hardware. 


Terminology 


The following terms are used throughout the discussion 
of descriptors, privilege levels, and protection: 


PL: Privilege Level—One of the four hierarchical 
privilege levels. Level 0 is the most privileged 
level and level 3 is the least privileged. 


RPL: Requestor Privilege Level—The privilege level 
of the original supplier of the selector. RPL is 
determined by the least two significant bits of a 
selector. 


DPL: Descriptor Privilege Level—This is the least 
privileged level at which a task may access that 
descriptor (and the segment associated with that 
descriptor). Descriptor Privilege Level is deter- 
mined by bits 6:5 in the Access Right Byte of a 
descriptor. 


CPL: Current Privilege Level—tThe privilege level at 
which a task is currently executing, which equals 
the privilege level of the code segment being 
executed. CPL can also be determined by 
examining the lowest 2 bits of the CS register, 
except for conforming code segments. 


EPL: Effective Privilege Level—tThe effective privilege 
level is the least privileged of the RPL and the 
DPL. EPL is the numerical maximum of RPL and 
DPL. 


Task: One instance of the execution of a program. 
Tasks are also referred to as processes. 


Descriptor Tables 


The descriptor tables define all of the segments which 
are used in an Am386SX/SXL microprocessor system. 
There are three types of tables which hold descriptors: 
the Global Descriptor Table, Local Descriptor Table, 
and Interrupt Descriptor Table. All of the tables are 
variable length memory arrays and can vary in size 
from 8 bytes to 64 Kb. Each table can hold up to 8192 
8-byte descriptors. The upper 13 bits of a selector are 
used as an index into the descriptor table. The tables 
have registers associated with them which hold the 
32-bit linear base address and the 16-bit limit of each 
table. 
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Figure 10. Descriptor Table Registers 
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Each of the tables has a register associated with it: 
GDTR, LDTR, and IDTR (see Figure 1). The LGDT, 
LLDT, and LIDT instructions load the base and limit of 
the Global, Local, and Interrupt Descriptor Tables into 
the appropriate register. The SGDT, SLDT, and SIDT 
store the base and limit values. These are privileged 
instructions. 


Global Descriptor Table 


The Global Descriptor Table (GDT) contains descriptors 
which are available to all of the tasks in a system. The 
GDT can contain any type of segment descriptor except 
for interrupt and trap descriptors. Every Am386SX/SXL 
CPU system contains a GDT. 


The first slot of the Global Descriptor Table corresponds 
to the null selector and is not used. The null selector 
defines a null pointer value. 


Local Descriptor Table 


LDTs contain descriptors which are associated with a 
given task. Generally, operating systems are designed 
so that each task has a separate LDT. The LDT may 
contain only code, data, stack, task gate, and call gate 
descriptors. LDTs provide a mechanism for isolating a 
giventask’s code and data segments fromthe rest of the 
operating system, while the GDT contains descriptors 
for segments which are common to all tasks. Asegment 
cannot be accessed by a task if its segment descriptor 
does not exist in either the current LDT orthe GDT. This 
provides both isolation and protection for a task’s seg- 
ments while still allowing global data to be shared 
among tasks. 


Unlike the 6-byte GDT or IDT registers which contain a 
base address and limit, the visible portion of the LDT 
register contains only a 16-bit selector. This selector 
refers to a Local Descriptor Table descriptor in the GDT 
(see Figure 1). 


Interrupt Descriptor Table 


The third table needed for AmM386SX/SXL microproces- 
sor systems is the Interrupt Descriptor Table. The IDT 
contains the descriptors which point to the location of 
the up to 256 interrupt service routines. The IDT may 
contain only task gates, interrupt gates, and trap gates. 
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The IDT should be at least 256 bytes in size in order to 
hold the descriptors for the 32 interrupts reserved for fu- 
ture use. Every interrupt used by a system must have an 
entry in the IDT. The IDT entries are referenced by INT 
instructions, external interrupt vectors, and exceptions. 


Descriptors 


The object to which the segment selector points to is 
called a descriptor. Descriptors are eight byte quantities 
which contain attributes about a given region of linear 
address space. These attributes include the 32-bit base 
linear address of the segment, the 20-bit length and 
granularity of the segment, the protection level, read, 
write, or execute privileges, the default size of the oper- 
ands (16 bit or 32 bit), and the type of segment. All of 
the attribute information about a segment is contained 
in 12 bits in the segment descriptor. Figure 11 shows 
the general format of a descriptor. All segments on the 
Am386SX/SXL microprocessor have three attribute 
fields in common: the P bit, the DPL bit, and the S bit. 
The P (Present) Bit is 1 if the segment is loaded in 
physical memory. If P=0, then any attempt to access 
this segment causes a Not Present exception (number 
11). The Descriptor Privilege Level (DPL) is a two bit 
field which specifies the protection level, 0-3, 
associated with a segment. 


The Am386SX/SXL microprocessor has two main 
categories of segments: system segments and non- 
system segments (for code and data). The segment bit 
(S) determines if a given segment is a system segment 
or a code or data segment. If the S bit is 1, then the 
segment is either a code or data segment; if it is 0, then 
the segment is a system segment. 


Code and Data Descriptors (S=1) 


Figure 12 shows the general format of a code and data 
descriptor, and Table 11 illustrates how the bits in the 
Access Right Byte are interpreted. 


Code and data segments have several descriptor fields 
in common. The accessed bit (A) is set whenever 
the processor accesses a descriptor. The granularity 
bit (G) specifies if a segment length is byte-granular or 
page-granular. 


0 Byte Address 






0 
Limit Base 

pecoaret [olofof an] ratte |Pfor|s| yee [A] as 
Base Base Address of the segment Accessed Bit 
Limit The length of the segment Q Granularity Bit (1 =Segment length is page-granular, 
P Present Bit (1 = Present, 0 = Not Present) 0 =Segment length is byte-granular) 
DPL Descriptor Privilege Level 0-3 Default Operation Size (recognized in code segment 
S Segment Descriptor (0 = System Descriptor, descriptors only; 1 =32-bit segment, 0 = 16-bit segment) 

1 =Code or Data Segment Descriptor) 0 Bit must be zero for compatibility with future processors 
Type Type of Segment AVL Available field for user or OS 
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Figure 11. Segment Descriptors 
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Figure 13. System Descriptors 


Table 11. Access Rights Byte Definition for Code and Data Descriptors 


Bit | 
a 


Present (P) Segment is mapped into physical memory. 
No mapping to physical memory exists, Base and Limit are 
not used. 


























Descriptor Privilege Levels (DPL) Segment privilege attribute used in privilege tests. 

















Segment Descriptor (S) S=x1 Code or Data (includes stacks) Segment Descriptor. 
S=0 System Segment Descriptor or Gate Descriptor. 
Executable (E) E=0 Descriptor type is data segment: if Dat 
a 
Expansion Direction (ED) ED=0 [Expand up segment, offsets must be < limit. Segment 
ED=1 Expand down segment, offsets must be > limit. (S=1 












| Writeable (W) 


0 Data segment may not be written into. E=0) 
1 


Data segment may be written into. 


== 












Executable (E) 


Descriptor type is code segment: 


Om 
ee 









lf Cod 
Conforming (C) Code segment may only be executed when Se aes 
CPL>DPL and CPL remains unchanged. (S 2 
Readable (R) = Code segment may not be read. oe 1) 


Code segment may be read. 














Accessed (A) Segment has not been accessed. 
Segment selector has been loaded into segment register 


or used by selector test instructions. 


>>rlvyv 
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System Descriptor Formats (S=0) 


System segments describe information about operating 
system tables, task, and gates. Figure 13 shows the 
general format of system segment descriptors, and the 
various types of system segments. Am386SX/SXL CPU 
system descriptors (which are the same as Am386DX/ 
DXL CPU system descriptors) contain a 32-bit base lin- 
ear address and a 20-bit segment limit. 80286 system 
descriptors have a 24-bit base address and a 16-bit 
segment limit. 80286 system descriptors are identified 
by the upper 16 bits being all zero. 


Differences Between Am386SX/SXL Microproces- 
sor and 80286 Descriptors 


In order to provide operating system compatibility with 
the 80286, the Am386SX/SXL CPU supports all of the 
80286 segment descriptors. The 80286 system 
segment descriptors contain a 24-bit base address and 
16-bit limit, while the Am386SX/SXL CPU system 
segment descriptors have a 32-bit base address, a 
20-bit limit field, and a granularity bit. The word count 
field specifies the number of 16-bit quantities to copy for 
80286 call gates and 32-bit quantities for Am386SX/ 
SXL CPU call gates. 


Selector Fields 


A selector in Protected Mode has three fields: Local or 
Global Descriptor Table Indicator (Tl), Descriptor Entry 
Index (Index), and Requestor (the selector’s) Privilege 
Level (RPL), as shown in Figure 14. The TI bit selects 
either the Global Descriptor Table or the Local 
Descriptor Table. The Index selects one of 8K descrip- 
tors in the appropriate descriptor table. The RPL bits 
allow high speed testing of the selector’s privilege 
attributes. 


Selector 


Segment 
Register 






Local Descriptor Table 
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Segment Descriptor Cache 


In addition to the selector value, every segment register 
has a segment descriptor cache register associated 
with it. Whenever a segment register’s contents are 
changed, the 8-byte descriptor associated with the 
selector is automatically loaded (cached) on the chip. 
Once loaded, all references to that segment use the 
cached descriptor information instead of reaccessing 
the descriptor. The contents of the descriptor cache are 
not visible to the programmer. Since descriptor caches 
only change when a segment register is changed, 
programs which modify the descriptor tables must 
reload the appropriate segment registers after changing 
a descriptor’s value. 


Protection 


The Am386SX/SXL microprocessor has four levels of 
protection which are optimized to support a multitasking 
operating system and to isolate and protect user 
programs from each other and the operating system. 
The privilege levels control the use of privileged 
instructions, I/O instructions, and access to segments 
and segment descriptors. The Am386SX/SXL micro- 
processor also offers an additional type of protection on 
a page basis when paging is enabled. 


The four-level hierarchical privilege system is an 
extension of the user/supervisor privilege mode 
commonly used by minicomputers. The user/supervisor 
mode is fully supported by the Am386SX/SXL micropro- 
cessor paging mechanism. The Privilege Levels (PL) 
are numbered 0 through 3. Level 0 is the most privileged 
level. 






Number 


Global Descriptor Table 
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Figure 14. Example Descriptor Selection 
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Table 12. Descriptor Types Used for Control Transfer 







Intersegment to the same or higher privilege level 









Interrupt within task may change CPL 






Task Switch 


*NT (Nested Task bit of flag register) = 0 
“NT (Nested Task bit of flag register) = 1 


Rules of Privilege 


The Am386SX/SXL microprocessor controls access to 
both data and procedures between levels of a task, 
according to the following rules: 


—Data stored in a segment with privilege level p can be 
accessed only by code executing at a privilege level at 
least as privileged as p. 


—A code segment/procedure with privilege level p can 
only be called by a task executing at the same or 
lesser privilege level than p. 


Privilege Levels 


At any point in time, a task on the Am386SX/SXL micro- 
processor always executes at one of the four privilege 
levels. The Current Privilege Level (CPL) specifies what 
the task’s privilege level is. A task’s CPL may only be 
changed by control transfers through gate descriptors to 
a code segment with a different privilege level. Thus, an 
application program running at PL=3 may call an 
operating system routine at PL=1 (via a gate) which 
would cause the task’s CPL to be set to 1 until the 
operating system routine was finished. 


Selector Privilege (RPL) 


The privilege level of a selector is specified by the RPL 
field. The selector’s RPL is only used to establish a less 
trusted privilege level than the current privilege level of 
the task for the use of asegment. This level is called the 
task’s Effective Privilege Level (EPL). The EPL is 
defined as being the least privileged (numerically larger) 
level of a task’s CPL and a selector’s RPL. The RPL is 
most commonly used to verify that pointers passed to an 
operating system procedure do not access data that is 


| Control Transfer Types | Operation Types 


Intersegment within the same privilege level | JMP, CALL, RET, IRET* Code Segment GDT/LDT 
CALL Call Gate GDT/LDT 


Interrupt Instruction, 
Exception, External 
Interrupt 


Intersegment to a lower privilege level | RET, IRET* Code Segment GDT/LDT 
(changes task CPL) 


CALL, JMP GDT/LDT 


IRET** 
Interrupt Instruction, 
Exception, External 
Interrupt 





Descriptor Descriptor 
Referenced Table 





Trap or Interrupt | 
Gate 


Task State GDT 
Segment 





DT 
_ 


of higher privilege than the procedure that originated the 
pointer. Since the originator of a selector can specify 
any RPL value, the Adjust RPL (ARPL) instruction is 
provided to force the RPL bits to the originator’s CPL. 


V/O Privilege 


The 1/O Privilege Level (IOPL) lets the operating system 
code executing at CPL=0 define the least privileged 
level at which I/O instructions can be used. An 
Exception 13 (General Protection Violation) is gen- 
erated if an I/O instruction is attempted when the CPL of 
the task is less privileged then the IOPL. The IOPL is 
stored in bits 13 and 14 of the EFLAGS register. The 
following instructions cause an Exception 13 if the CPL 
is greater than JOPL: IN, INS, OUT, OUTS, STI, CLI, 
and LOCK prefix. 


Descriptor Access 


There are basically two types of segment accesses: 
those involving code segments such as control trans- 
fers, and those involving data accesses. Determining 
the ability of a task to access a segment involves the 
type of segment to be accessed, the instruction used, 
the type of descriptor used, and CPL, RPL, and DPL as 
described above. 


Any time an instruction loads a data segment register 
(DS, ES, FS, GS) the Am386SX/SXL CPU makes pro- 
tection validation checks. Selectors loaded in the DS, 
ES, FS, GS registers must refer only to data segment or 
readable code segments. 


Finally, the privilege validation checks are performed. 
The CPL is compared to the EPL and if the EPL is more 
privileged than the CPL, an Exception 13 (General 
Protection Fault) is generated. 
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Type=9: Available TSS. 15022B-006 
Type =B: Busy TSS. 


Figure 15. TSS and TSS Registers 
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Figure 16. Sample I/O Permission Bit Map 


The rules regarding the stack segment are slightly differ- 
ent than those involving data segments. Instructions 
that load selectors into SS must refer to data segment 
descriptors for writeable data segments. The DPL and 
RPL must equal the CPL of all other descriptor types ora 
privilege level violation will cause an Exception 13. A 
stack not present fault causes an Exception 12. 


Privilege Level Transfers 


Inter-segment control transfers occur when a selector is 
loaded in the CS register. For a typical system most of 
these transfers are simply the result of a call or a jump to 
another routine. There are five types of control transfers 
which are summarized in Table 12. Many of these 
transfers result in a privilege level transfer. Changing 
privilege levels is done only by control transfers, using 
gates, task switches, and interrupt or trap gates. 


Control transfers can only occur if the operation which 
loaded the selector references the correct descriptor 
type. Any violation of these descriptor usage rules will 
cause an Exception 13. 


CALL Gates 


Gates provide protected indirect CALLs. One of the 
major uses of gates is to provide a secure method of 
privilege transfers within a task. Since the operating 
system defines all of the gates in a system, it can ensure 
that all gates only allow entry into a few trusted 
procedures. 


Task Switching 


Avery important attribute of any multitasking/multi-user 
operating system is its ability to rapidly switch between 
tasks or processes. The Am386SX/SXL microproces- 
sor directly supports this operation by providing a task 
switch instruction in hardware. The task switch oper- 
ation saves the entire state of the machine (all of the 
registers, address space, and a link to the previous 
task), loads a new execution state, performs protection 
checks, and commences execution in the new task. Like 
transfer of control by gates, the task switch operation is 
invoked by executing an intersegment JMP or CALL 
instruction which refers to a Task State Segment (TSS), 
or a task gate descriptor in the GDT or LDT. An INT n 
instruction, exception, trap, or external interrupt may 


also invoke the task switch operation if there is a task 
gate descriptor in the associated IDT descriptor slot. 


The TSS descriptor points to a segment (See Figure 15) 
containing the entire execution state. A task gate 
descriptor contains a TSS selector. The AM386SX/SXL 
microprocessor supports both 80286 and Am386SX/ 
SXL CPU TSSs. The limit of an AmM386SX/SXL CPU 
TSS must be greater than 64H (2BH for a 80286 TSS), 
and can be as large as 16 Mb. In the additional TSS 
space, the operating system is free to store additional 
information such as the reason the task is inactive, the 
time the task has spent running, or open files belonging 
to the task. 


Each task must have a TSS associated with it. The 
current TSS is identified by a special register in the 
Am386SX/SXL microprocessor called the Task State 
Segment Register (TR). This register contains a 
selector referring to the task state segment descriptor 
that defines the current TSS. A hidden base and limit 
register associated with TSS descriptor are loaded 
whenever TR is loaded with a new selector. Returning 
from a task is accomplished by the IRET instruction. 
When IRET is executed, control is returned to the task 
which was interrupted. The currently executing task’s 
state is saved in the TSS and the old task state is 
restored from its TSS. 


Several bits in the flag register and machine status word 
(CRO) give information about the state of a task which is 
useful to the operating system. The Nested Task bit 


(NT) controls the function of the IRET instruction. If 


NT = 0, the IRET instruction performs the regular return. 
If NT = 1, IRET performs a task switch operation base to 
the previous task. The NT bit is set or reset in the 
following fashion: 


When a CALL or INT instruction initiates a task 
switch, the new TSS will be marked busy and the 
back link field of the new TSS set to the old TSS 
selector. The NT bit of the new task is set by CALL 
or INT initiated task switches. An interrupt that 
does not cause a task switch will clear NT (the NT 
bit will be restored after execution of the interrupt 
handler). NT may also be set or cleared by POPF 
or IRET instructions. 
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The Am386SX/SXL microprocessor task state seg- 
ment is marked busy by changing the descriptor type 
field from Type 9 to Type OBH. An 80286 TSS is marked 
busy by changing the descriptor type field from Type 1 
to Type 3. Use of a selector that references a busy task 
state segment causes an Exception 13. 


The VM (Virtual Mode) bit is used to indicate if ataskis a 
Virtual 8086 task. If VM = 1 then the tasks will use the 
Real Mode addressing mechanism. The Virtual 8086 
environment is only entered and exited by a task switch. 


The coprocessor’s state is not automatically saved 
when a task switch occurs. The Task Switched Bit (TS) 
in the CRO register helps deal with the coprocessor’s 
state in a multitasking environment. Whenever the 
Am386SX/SXL microprocessor switches tasks, it sets 
the TS bit. The Am386SX/SXL CPU detects the first use 
of a processor extension instruction after a task switch 
and causes the processor extension Not Available 
Exception 7. The exception handler for Exception 7 
may then decide whether to save the state of the 
coprocessor. 


The T bit in the Am3886SX/SXL microprocessor TSS 
indicates that the processor should generate a debug 
exception when switching to a task. lf T=1, then 
upon entry to a new task a debug Exception 1 will be 
generated. 


Initialization and Transition To Protected Mode 


Since the Am386SX/SXL microprocessor begins 
executing in Real Mode immediately after RESET, it is 
necessary to initialize the system tables and registers 
with the appropriate values. The GDT and IDT registers 
must refer to a valid GDT and IDT. The IDT should be at 
least 256 bytes long, and the GDT must contain 
descriptors for the initial code and data segments. 


Protected Mode is enabled by loading CRO with PE bit 
set. This can be accomplished by using the MOV CRO, 
R/M instruction. After enabling Protected Mode, the 
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next instruction should execute an intersegment JMP 
to load the CS register and flush the instruction decode 
queue. The final step is to load all of the data segment 
registers with the initial selector values. 


An alternate approach to entering Protected Mode is to 
use the built in task-switch to load all of the registers. In 
this case the GDT would contain two TSS descriptors in 
addition to the code and data descriptors needed for the 
first task. The first JMP instruction in Protected Mode 
would jump to the TSS causing a task switch and load- 
ing all of the registers with the values stored in the TSS. 
The Task State Segment Register should be initialized 
to point to a valid TSS descriptor. 


Paging 


Paging is another type of memory management useful 
for virtual memory multitasking operating systems. Un- 
like segmentation, which modularizes programs and 
data into variable length segments, paging divides pro- 
grams into multiple uniform size pages. Pages bear no 
direct relation to the logical structure of a program. 
While segment selectors can be considered the logical 
name of a program module or data structure, a page 
most likely corresponds to only a portion of a module or 
data structure. 


Page Organization 


The Am386SX/SXL microprocessor uses two levels of 
tables to translate the linear address (from the segmen- 
tation unit) into a physical address. There are three 
components to the paging mechanism of the Am386SX/ 
SXL CPU: the Page Directory, the Page Tables, andthe 
page itself (Page Frame). All memory-resident ele- 
ments of the Am386SX/SXL microprocessor paging 
mechanism are the same size, namely 4 Kb. A uniform 
size for all of the elements simplifies memory allocation 
and reallocation schemes, since there is no problem 
with memory fragmentation. Figure 17 shows how the 
paging mechanism works. 


Two Level Paging Scheme 
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Figure 17. Paging Mechanism 
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Figure 18. Page Directory Entry (Points to Page Table) 
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Figure 19. Page Table Entry (Points to Page) 


Page Fault Register 


CR2 is the Page Fault Linear Address register. It holds 
the 32-bit linear address which caused the last Page 
Fault detected. 


Page Descriptor Base Register 


CR3 is the Page Directory Physical Base Address 
Register. It contains the physical starting address of the 
Page Directory (this value is truncated to a 24-bit value 
associated with the Am3886SX/SXL CPU’s 16-Mb 
physical memory limitation). The lower 12 bits of CR3 
are always zero to ensure that the Page Directory is 
always page aligned. Loading it with a MOV CR3, reg 
instruction causes the Page Table entry cache to be 
flushed, as will a task switch through a TSS which 
changes the value of CRO. 


Page Directory 


The Page Directory is 4-Kb long and allows up to 1024 
Page Directory entries. Each Page Directory entry 
contains information about the Page Table and the 
address of the next level of tables, the Page Tables. The 
contents of a Page Directory entry are shown in Figure 
18. The upper 10 bits of the linear address (A31-A22) 
are used as an index to select the correct Page Directory 
entry. 


The Page Table address contains the upper 20 bits of a 
32-bit physical address that is used as the base address 
for the next set of tables, the Page Tables. The lower 
12 bits of the Page Table addresses appear on 4-Kb 
boundaries. For an Am386DX/DXL CPU system, the 
upper 20 bits will select one of 22° Page Tables, but for 
an Am3886SX/SXL microprocessor system, the upper 
20 bits only select one of 2'? Page Tables. Again, this is 
because the Am386SX/SXL CPU is limited to a 24-bit 
physical address, and the upper 8 bits (A31—A24) are 
truncated when the address is output on its 24 address 
pins. 


Page Tables 


Each Page Table is 4-Kb long and allows up to 1024 
Page Table entries. Each Page Table entry contains in- 
formation about the Page Frame and its address. The 
contents of a Page Table entry are shown in Figure 
19. The middle 10 bits of the linear address (A21—A12) 


are used as an index to select the correct Page Table 
entry. 


The Page Frame address contains the upper 20 bits of 
a 32-bit physical address which is used as the base 
address for the Page Frame. The lower 12 bits of the 
Page Frame address are zero so that the Page Frame 
addresses appear on 4-Kb boundaries. For an 
Am386DX/DXL CPU system, the upper 20 bits will se- 
lect one of 27? Page Frames, but for an Am386SX/ 
SXL microprocessor system, the upper 20 bits only 
select one of 2'? Page Frames. Again, this is because 
the Am386SX/SXL CPU is limited to a 24-bit physical 
address space, and the upper 8 bits (A31—-A24) are 
truncated when the address is output on its 24 address 
pins. 


Page Directory/Table Entries 


The lower 12 bits of the Page Table entries and Page Di- 
rectory entries contain statistical information about 
pages and Page Tables, respectively. The P (Present) 
bit indicates if a Page Directory or Page Table entry can 
be used in address translation. If P = 1, the entry can be 
used for address translation. If P = 0, the entry cannot 
be used fortranslation. All of the other bits, are available 
for use by the software. For example, the remaining 31 
bits could be used to indicate where on disk the page is 
stored. 


The A (Accessed) bit is set by the Am3886SX/SXL CPU 
for both types of entries before a read or write access 
occurs to an address covered by the entry. The D (Dirty) 
bit is set to 1 before a write to an address covered by that 
Page Table entry occurs. The D bit is undefined for Page 
Directory entries. When the P, A, and D bits are updated 
by the Am386SX/SXL CPU, the processor generates a 
Read-Modify-Write cycle which locks the bus and pre- 
vents conflicts with other processors or peripherals. 
Software which modifies these bits should use the 
LOCK prefix to ensure the integrity of the Page Tables in 
multi-master systems. 


The 3 bits marked system software definable (in Figures 
18 and 19) are software definable. System software 
writers are free to use these bits for whatever purpose 
they wish. 
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Page Levei Protection (R/W, U/S Bits) 


The Am386SX/SXL microprocessor provides a set of 
protection attributes for paging systems. The paging 
mechanism distinguishes between two levels of 
protection: User, which corresponds to level 3 of the 
segmentation based protection; and Supervisor, which 
encompasses all of the other protection levels (0, 1, 
and 2). Programs executing at Level 0, 1, or 2 bypass 
the page protection, although segmentation-based 
protection is still enforced by the hardware. 


The U/S and R/W bits are used to provide User/ 
Supervisor and Read/Write protection for individual 
pages, or for all pages covered by a Page Table 
Directory entry. The U/S and R/W bits in the second 
level Page Table entry apply only to the page described 
by that entry. The U/S and R/W bits in the first level Page 
Directory Table apply to all pages described by the Page 
Table pointed to by that directory entry. The U/S and 
R/W bits for a given page are obtained by taking the 
most restrictive of the U/S and R/W bits from the Page 
Directory Table entries and using these bits to address 
the page. 


Translation Look-Aside Buffer 


The Am386SX/SXL microprocessor paging hardware is 
designed to support demand paged virtual memory 
systems. However, performance would degrade 
substantially if the processor was required to access two 
levels of tables for every memory reference. To solve 
this problem, the AmM386SX/SXL CPU keeps a cache of 
the most recently accessed pages; this cache is called 
the Translation Look-Aside Buffer (TLB). The TLB is 
a four-way set associative 32-entry Page Table cache. 
It automatically keeps the most commonly used Page 
Table entries in the processor. The 32-entry TLB 
coupled with a 4K page size results in coverage of 128 
Kb of memory addresses. For many common multitask- 
ing systems, the TLB will have a hit rate of greater than 
98%. This means that the processor will only have to 
access the two-level page structure for less than 2% of 
all memory references. 


Paging Operation 


The paging hardware operates in the following fashion. 
The paging unit hardware receives a 32-bit linear 
address fromthe segmentation unit. The upper 20 linear 
address bits are compared with all 32 entries inthe TLB 
to determine if there is a match. If there is a match (i.e., a 
TLB hit), then the 24-bit physical address is calculated 
and is placed on the address bus. 


Ifthe Page Table entry is not in the TLB, the Am386SX/ 
SXL microprocessor will read the appropriate Page 
Directory entry. If P = 1 onthe Page Directory entry, indi- 
cating that the Page Table is in memory, then the 
Am386SX/SXL CPU will read the appropriate Page 
Table entry and set the Access bit. If P = 1 on the 
Page Table entry, indicating that the page is in memory, 
the Am386SX/SXL microprocessor will update the 
Access and Dirty bits as needed and fetch the operand. 
The upper 20 bits of the linear address, read from the 
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Page Table, will be stored in the TLB for future 
accesses. If P =0 for either the Page Directory entry or 
the Page Table entry, then the processor will generate a 
Page Fault (Exception 14). 


The processor will also generate a Page Fault 
(Exception 14) if the memory reference violated the 
page protection attributes. CR2 will hold the linear 
address which caused the Page Fault. Since Exception 
14 is classified as a fault, CS:EIP will point to the 
instruction causing the Page Fault. The 16-bit error 
code, pushed as part of the Page Fault handler, will 
contain status bits which indicate the cause of the Page 
Fault. 


The 16-bit error code is used by the operating system to 
determine how to handle the Page Fault. Figure 20 
shows the format of the Page Fault error code and the 
interpretation of the bits. Even though the bits in the 
error code (U/S, W/R, and P) have similar names as the 
bits in the Page Directory/Table Entries, the interpreta- 
tion of the error code bits is different. Figure 21 indicates 
what type of access caused the Page Fault. 


U/S: The U/S bit indicates whether the access causing 
the fault occurred when the processor was executing in 
User Mode (U/S = 1) or in Supervisor mode (U/S = 0). 


W/R: The W/R bit indicates whether the access causing 
the fault was a Read (W/R = 0) or a Write (W/R = 1). 


P: The P bit indicates whether a Page Fault was caused 
by a not-present page (P = 0), or by a page level protec- 
tion violation (P=1). 


U = Undefined 





Figure 20. Page Fault Error Code Format 


LYS} wh | Access Type | 






Supervisor* Read 
Supervisor Write 
User Read 


2 table access will fault with U/S = 0, even if the program is 
executing at level 3. 


Figure 21. Type of Access Causing Page Fault 





Operating System Responsibilities 


When the operating system enters or exits paging mode 
(by setting or resetting bit 31 in the CRO register), a 
short JMP must be executed to flush the Am386SX/SXL 
microprocessor’s prefetch queue. This ensures that all 
instructions executed after the address mode change 
will generate correct addresses. 


The Am386SX/SXL microprocessor takes care of the 
page address translation process, relieving the burden 
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from an operating system in a demand-paged system. 
The operating system is responsible for setting up the 
initial Page Tables and handling any Page Faults. The 
operating system is also required to invalidate (i.e., 
flush) the TLB when any changes are made to any of the 
Page Table entries. The operating system must reload 
CR3 to cause the TLB to be flushed. 


Setting up the tables is simply a matter of loading CR3 
with the address of the Page Directory, and allocating 
space for the Page Directory and the Page Tables. The 
primary responsibility of the operating system is to 
implement a swapping policy and handle all of the 
Page Faults. 


A final concern of the operating system is to ensure that 
the TLB cache matches the information in the paging 
tables. In particular, any time the operating systems sets 
the P (Present) bit of Page Table entry to zero, the TLB 
must be flushed by reloading CR3. Operating systems 
may want to take advantage of the fact that CR3 is 
stored as part of a TSS, to give every task or group of 
tasks its own set of Page Tables. 


Virtual 8086 Environment 


The Am386SX/SXL microprocessor allows the execu- 
tion of 8086 application programs in both Real Mode 
and in Virtual 8086 Mode. The Virtual 8086 Mode allows 
the execution of 8086 applications, while still allowing 
the system designer to take full advantage of the 
Am386SX/SXL CPU’s protection mechanism. | 


Virtual 8086 Addressing Mechanism 


One of the major differences between Am386SX/SXL 
CPU Real and Protected modes is how the segment 
selectors are interpreted. When the processor is 
executing in Virtual 8086 Mode, the segment registers 
are used in a fashion identical to Real Mode. The 
contents of the segment register are shifted left four 
bits and added to the offset to form the segment base 
linear address. 


The Am3886SX/SXL microprocessor allows the oper- 
ating system to specify which programs use the 8086 
address mechanism and which programs use Protected 
Mode addressing on a per task basis. Through the use 
of paging, the 1-Mb address space of the Virtual Mode 
task can be mapped to anywhere in the 4-Gb linear 
address space of the Am386SX/SXL CPU. Like Real 
Mode, Virtual Mode addresses that exceed 1 Mb will 
cause an Exception 13. However, these restrictions 
should not prove to be important, because most tasks 
running in Virtual 8086 Mode will simply be existing 
8086 application programs. 


Paging in Virtual Mode 


The paging hardware allows the concurrent running of 
multiple Virtual Mode tasks, and provides protection and 
operating system isolation. Although it is not strictly 
necessary to have the paging hardware enabled to run 
Virtual Mode tasks, it is needed in order to run multiple 
Virtual Mode tasks or to relocate the address space of a 


Virtual Mode task to physical address space greater 
than 1 Mb. 


The paging hardware allows the 20-bit linear address 
produced by a Virtual Mode program to be divided into 
as many as 256 pages. Each one of the pages can be 
located anywhere within the maximum 16-Mb physical 
address space of the Am386SX/SXL microprocessor. In 
addition, since CR3 (the Page Directory Base Register) 
is loaded by a task switch, each Virtual Mode task can 
use a different mapping scheme to map pages to 
different physical locations. Finally, the paging 
hardware allows the sharing of the 8086 operating 
system code between multiple 8086 applications. 


Protection and I/O Permission Bit Map 


All Virtual Mode programs execute at privilege level 3. 
As such, Virtual Mode programs are subject to all of the 
protection checks defined in Protected Mode. This 
is different from Real Mode, which implicitly is executing 
at privilege level 0. Thus, an attempt to execute a 
privileged instruction in Virtual Mode will cause an 
Exception 13 fault. 


The following are privileged instructions, which may be 
executed only at Privilege level 0. Attempting to execute 
these instructions in Virtual 8086 Mode (or anytime 
CPL= 0) causes an Exception 13 fault: 


LiDT; MOV DRn, REG; MOV reg,DRn; 
LGDT; MOV TRn,reg; MOV reg,TRn; 
LMSW; MOV CRn, reg; MOV reg,CRn; 
CLTS; 
HLT; 


Several instructions, particularly those applying to the 
multitasking and the protection model, are available 
only in Protected Mode. Therefore, attempting to exe- 
cute the following instructions in Real Mode or in Virtual 
8086 Mode generates an Exception 6 fault: 


LTR; STR; 
LLDT; SLT: 
LAR; VERR; 
LSL; VERW ; 
ARPL; 


The instructions which are IOPL sensitive in Protected 
Mode are: . 


IN; STL: 
OUT; CLI 
INS; 

OUTS; 

REP INS; 

REP OUTS; 


In Virtual 8086 Mode the following instructions are IOPL 
sensitive: 


INT n; Srl; 
PUSHF; Cit; 
POPF; IRET; 
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The PUSHF, POPF, and IRET instructions are IOPL 
sensitive in Virtual 8086 Mode only. This provision 
allows the IF flag to be virtualized to the virtual 8086 
Mode program. The INT n software interrupt instruction 
is also IOPL sensitive in Virtual 8086 Mode. Note that 
the INT 3, INTO, and BOUND instructions are not IOPL 
sensitive in Virtual 8086 Mode. 


The 1/O instructions that directly refer to addresses in 
the processor’s I/O space are IN, INS, OUT, and OUTS. 
The Am386SX/SXL microprocessor has the ability to 
selectively trap references to specific 1/O addresses. 
The structure that enables selective trapping is the I/O 
Permission Bit Map inthe TSS segment (See Figures 15 
and 16). The I/O permission map is a bit vector. The size 
of the map and its location in the TSS segment are 
variable. The processor locates the I/O permission map 
by means of the |/O map base field in the fixed portion of 
the TSS. The I/O map base field is 16-bits wide and 
contains the offset of the beginning of the I/O permission 
map. 


In protected mode, when an |/O instruction (IN, INS, 
OUT, or OUTS) is encountered, the processor first 
checks whether CPL < IOPL. If this condition is true, the 
I/O operation may proceed. If not true, the processor 
checks the I/O permission map (in Virtual 8086 Mode, 
the processor consults the map without regard for the 
IOPL). 


Each bit in the map corresponds to an I/O port byte 
address; for example, the bit for port 41 is found at I/O 
map base +5, bit offset 1. The processor tests all the bits 
that correspond to the I/O addresses spanned by an I/O 
operation; for example, a Dword operation tests four 
bits corresponding to four adjacent byte addresses. If 
any tested bit is set, the processor signals a general 
protection exception. If all the tested bits are zero, the 
I/O operations may proceed. 


It is not necessary for the I/O permission map to 
represent all the I/O addresses. I/O addresses not 
spanned by the map are treated as if they had one-bits in 
the map. The I/O map base should be at least one byte 
less than the TSS limit; the last byte beyond the I/O 
mapping information must contain all 1s. 


Because the I/O permission map is inthe TSS segment, 
different tasks can have different maps. Thus, the 
operating system can allocate ports to a task by 
changing the I/O permission map in the task’s TSS. 


Important Implementation Note: Beyond the last byte 
of I/O mapping information in the I/O permission bit map 
must be a byte containing all 1s. The byte of all 1s must 
be within the limit of the Am386SX/SXL CPU TSS 
segment (see Figure 15). 


Interrupt Handling 


In order to fully support the emulation of an 8086 
machine, interrupts in Virtual 8086 Mode are handled in 
a unique fashion. When running in Virtual Mode all 
interrupts and exceptions involve a privilege change 
back to the host Am3886SX/SXL microprocessor 
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operating system. The AmM386SX/SXL CPU operating 
system deter-mines if the interrupt comes from a 
Protected Mode application, or from a Virtual Mode 
program, by examining the VM bit in the EFLAGS image 
stored on the stack. 


When a Virtual Mode program is interrupted, and 
execution passes to the interrupt routine at level 0, the 
VM bit is cleared. However, the VM bit is still set in the 
EFLAGS image on the stack. 


The Am386SX/SXL microprocessor operating system 
in turn handles the exception or interrupt and then 
returns control to the 8086 program. The Am386SX/ 
SXL microprocessor operating system may choose to 
let the 8086 operating system handle the interrupt, or it 
may emulate the function of the interrupt handler. For 
example, many 8086 operating system calls are 
accessed by PUSHing parameters on the stack, and 
then executing an INT n instruction. If the IOPL is set to 
0, then all INT n instructions will be intercepted by the 
Am386SX/SXL CPU operating system. 


An Am386SX/SXL microprocessor operating system 
can provide a Virtual 8086 environment which is totally 
transparent to the application software by intercepting 
and then emulating 8086 operating system’s calls, and 
intercepting IN and OUT instructions. 


Entering and Leaving Virtual 8086 Mode 


Virtual 8086 Mode is entered by executing a 32-bit IRET 
instruction at CPL = 0, where the stack has a 1 inthe VM 
bit of its EFLAGS image, or a Task Switch (at any CPL) 
to an Am886SX/SXL microprocessor task whose 
Am386SX/SXL CPU TSS has an EFLAGS image 
containing a1 inthe VM bit position, while the processor 
is executing in the Protected Mode. POPF does not 
affect the VM bit, but a PUSHF always pushes a 0 in the 
VM bit. 


The transition out of Virtual 8086 Mode to Protected 
Mode occurs only on receipt of an interrupt or exception. 
In Virtual 8086 Mode, all interrupts and exceptions 
vector through the Protected Mode IDT, and enter an 
interrupt handler in Protected Mode. As part of the 
interrupt processing the VM bit is cleared. 


Because the matching IRET must occur from Level 0, 
Interrupt or Trap Gates used to field an interrupt or 
exception out of Virtual 8086 Mode must perform an 
inter-level interrupt only to Level 0. Interrupt or Trap 
Gates through conforming segments, or through 
segments with DPL > 0, will raise a GP fault with the CS 
selector as the error code. 


Task Switches To/From Virtual 8086 Mode 


Tasks which can execute in Virtual 8086 Mode must be 
described by a TSS with the Am386SX/SXL CPU for- 
mat (Type 9 or 11 descriptor). A task switch out of 
Virtual 8086 Mode will operate exactly the same as any 
other task switch out of a task with an Am386SX/SXL 
CPU TSS. All of the programmer visible state, including 
the EFLAGS register with the VM bit set to 1, is stored in 
the TSS. The segment registers in the TSS will contain 
8086 segment base values rather than selectors. 
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A task switch into a task described by an Am386SX/SXL 
CPU TSS will have an additional check to determine if 
the incoming task should be resumed in Virtual 8086 
Mode. Tasks described by 80286 format TSSs cannot 
be resumed in Virtual 8086 Mode, so no check is re- 
quired there (the FLAGS image in 80286 format TSS 
has only the low-order 16 FLAGS bits). Before loading 
the segment register images from an Am386SX/SXL 
CPU TSS, the FLAGS image is loaded, so that the 
segment registers are loaded from the TSS image as 
8086 segment base values. The task is now ready to 
resume in Virtual 8086 Mode. 


Transitions Through Trap and Interrupt Gates, and 
IRET 

A task switch is one way to enter or exit Virtual 8086 
Mode. The other method is to exit through a Trap or 
Interrupt gate, as part of handling an interrupt, and to 
enter as part of executing an IRET instruction. The 
transition out must use an Am386SX/SXL CPU Trap 
Gate (Type 14), or Am386SX/SXL CPU Interrupt Gate 
(Type 15), which must point to a non-conforming Level 0 
segment (DPL = 0) in order to permit the trap handler to 
IRET back to the Virtual 8086 program. The Gate must 
point to anon-conforming Level 0 segment to performa 
level switch to Level 0 so that the matching IRET can 
change the VM bit. Am386SX/SXL CPU gates must be 
used since 80286 gates save only the lower 16 bits of 
the EFLAGS register (the VM bit will not be saved). Also, 
the 16-bit IRET used to terminate the 80286 interrupt 
handler will pop only the lower 16 bits from FLAGS, and 
will not affect the VM bit. The action taken for an 
Am386SX/SXL CPU Trap or Interrupt gate, if an 
interrupt occurs while the task is executing in Virtual 
8086 Mode, is given by the following sequence: 


1. Save the FLAGS register in a temp to push later. 
Turn off the VM, TF, and IF bits. 


2. Interrupt and Trap gates must perform a level switch 
from 3 (where the Virtual 8086 Mode program 
executes) to 0 (so IRET can return). 


3. Pushthe 8086 segment register values onto the new 
stack, in this order: GS, FS, DS, and ES. These are 
pushed as 32-bit quantities. Then load these 4 
registers with null selectors (0). 


4. Push the old 8086 stack pointer onto the new stack 
by pushing the SS register (as 32 bits), then pushing 
the 32-bit ESP register saved above. 


5. Push the 32-bit EFLAGS register saved in step 1. 


6. Push the old 8086 instruction onto the new stack by 
pushing the CS register (as 32 bits), then pushing the 
32-bit EIP register. 


7. Load up the new CS:EIP value from the interrupt 
gate, and begin execution of the interrupt routine in 
protected mode. 


The transition out of Virtual 8086 Mode performs a level 
change and stack switch, in addition to changing back to 
protected mode. Also, all of the 8086 segment register 
images are stored on the stack (behind the SS:ESP 


image), and then loaded with null (0) selectors before 
entering the interrupt handler. This will permit the 
handler to safely save and restore the DS, ES, FS, and 
GS registers as 80286 selectors. This is needed so that 
interrupt handlers, which do not care about the mode of 
the interrupted program, can use the same prologue 
and epilogue code for state saving, regardless of 
whether or not a native mode or Virtual 8086 Mode 
program was interrupted. Restoring null selectors to 
these registers before executing the IRET will cause a 
trap in the interrupt handler. Interrupt routines which 
expect or return values in the segment registers will 
have to dbtain/return values from the 8086 register 
images pushed onto the new stack. They will need 
to know the mode of the interrupted program in order to 
know where to find/return segment registers, and also 
to know how to interpret segment register values. 


The IRET instruction will perform the inverse of the 
above sequence. Only the extended IRET instruction 
(operand size = 32) can be used, and must be executed 
at Level 0, to change the VM bit to 7. 


1. Ifthe NT bit inthe FLAGS register is On, an intertask 
return is performed. The current state is stored in the 
current TSS, and the link field in the current TSS is 
used to locate the TSS for the interrupted task which 
is to be resumed. Otherwise, continue with the 
following sequence. 


2. Read the FLAGS image from SS:8[ESP] into the 
FLAGS register. This will set VM to the value active 
in the interrupted routine. 


3. Pop off the instruction pointer CS:EIP. EIP is pop- 
ped first, then a 32-bit word is popped which contains 
the CS value in the lower 16 bits. If VM = 0, this CS 
load is done as a protected mode segment load. If 
VM = 1, this will be done as an 8086 segment load. 


4. Increment the ESP register by 4 to bypass the 
FLAGS image which was popped in step 1. 


5. If VM = 1, load segment registers ES, DS, FS, and 
GS from memory locations SS:[ESP + 8], SS:[ESP + 
12], SS:[ESP + 16], andSS:[ESP = 20], respectively, 
where the new value of ESP stored in step 4 is used. 
Since VM = 1, these are done as 8086 segment 
register loads. 


Else if VM=0, check that the selectors in ES, DS, 
FS, and GS are valid in the interrupted routines. Null 
out invalid selectors to trap, if an attempt is made to 
access through them. 


6. If RPL (CS) > CPL, pop the stack pointer SS:ESP 
from the stack. The ESP register is popped first, 
followed by 32 bits containing SS in the lower 16 
bits. If VM = 0, SS is loaded as a protected mode 
segment register load. If VM = 1, an 8086 segment 
register load is used. 


7. Resume execution of the interrupted routine. The 
VM bit in the FLAGS register (restored from the 
interrupt routine’s stack image in step 1) determines 
whether the processor resumes the interrupted 
routine in Protected Mode or Virtual 8086 Mode. 
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FUNCTIONAL DATA 


The Am386SX/SXL microprocessor features a straight- 
forward functional interface to the external hardware. 
The Am386SX/SXL CPU has separate parallel buses 
for data and address. The data bus is 16-bits in width, 
and bidirectional. The address bus outputs 24-bit 
address values using 23 address lines and two Byte 
Enable signals. 


The Am386SX/SXL microprocessor has two selectable 
address bus cycles: address pipelined and non-address 
pipelined. The address pipelining option allows as much 
time as possible for data access by starting the pending 
bus cycle before the present bus cycle is finished. A 
non-pipelined bus cycle gives the highest bus 
performance by executing every bus cycle in two 
processor CLK cycles. For maximum design flexibility, 
the address pipelining option is selectable on a 
cycle-by-cycle basis. 


The processor's bus cycle is the basic mechanism for 
information transfer, either from system to processor, or 
from processor to system. The Am3886SX/SXL micro- 
processor bus cycles perform data transfer in a 
minimum of only two clock periods. The maximum 
transfer band-width at 16 MHz is therefore 16 Mb/s. 
However, any bus cycle will be extended for more than 
two clock periods if external hardware withholds ac- 
knowledgment of the cycle. 


The Am386SX/SXL microprocessor can relinquish 
control of its local buses to allow mastership by other 
devices, such as Direct Memory Access (DMA) 
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channels. When relinquished, HLDA is the only output 
pin driven by the Am386SX/SXL microprocessor, 
providing near complete isolation of the processor from 
its system (all other output pins are in a float condition). 


Signal Description Overview 


Below is a brief description of the Am386SX/SXL micro- 
processor input and output signals arranged by 
functional groups. 


Example signal: M/(O—High voltage indicates memory 
selected 

—Low voltage 
selected 


The signal descriptions sometimes refer to Switching 
timing parameters, such as t25 Reset Setup Time and 
t26 Reset Hold Time. The values of these parameters 
can be found in the Switching Characteristics table. 


Clock (CLK2) 


CLK2 provides the fundamental timing for the 
Am386SX/SXL microprocessor. It is divided by two in- 
ternally to generate the internal processor clock used 
for instruction execution. The internal clock is comprised 
of two phases, phase one and phase two. Each CLK2 
period is a phase of the internal clock. Figure 23 
illustrates the relationship. If desired, the phase of the 
internal processor clock can be synchronized to a 
known phase by ensuring the falling edge of the RESET 
signal meets the applicable setup and hold times, t25 
and t26. | 


indicates I/O 


2X Clock { CL KA Address Bus A23-A1 
BHE 24-Bit Address 
16-Bit Data { D15—Do — Byte 
Enables 
ADS W/R 
Bus Control NA ae 
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READY Microprocessor Bus Cycle Definition 
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RESET FLT 
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Figure 22. Functional Signal Groups 
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Figure 23. CLK2 Signal and Internal Processor Clock 


Data Bus (D15—D0) 


These three-state, bidirectional signals provide the 
general purpose data path between the Am386SX/SXL 
microprocessor and other devices. The data bus 
outputs are active High and will float during Bus Hold 
Acknowledge. Data bus reads require that read-data 
setup and hold times (t21 and t22) be met relative to 
CLK2 for correct operation. 


Address Bus (A23-A1, BHE, BLE) 


These three-state outputs provide physical memory 
addresses or I/O port addresses. A23—-A16 are Low 
during I/O transfers, except for I/O transfers automati- 
cally generated by coprocessor instructions. During 
coprocessor I/O transfers, A22—A16 are driven Low and 
A23 is driven High, so that this address line can be used 
by external logic to generate the coprocessor select 
signal. Thus, the I/O address driven by the Am386SX/ 
SXL microprocessor for coprocessor commands is 
8000F8H, the I/O addresses driven by the Am386SX/ 
SXL CPU for coprocessor data are 8000FCH or 
8000FEH or cycles to a 387SX math coprocessor. 


The address bus is capable of addressing 16 Mb of 
physical memory space (OOQQ000H through FFFFFFH), 
and 64 Kb of I/O address space (000000H through 
OOFFFFH) for programmed I/O. The address bus is 
active High and will float during Bus Hold Acknowledge. 


The Byte Enable outputs, BHE and BLE, directly 
indicate which bytes of the 16-bit data bus are involved 
with the current transfer. BHE applies to D15—D8 and 
BLE applies to D7—DO. If both BHE and BLE are 
asserted, then 16 bits of data are being transferred. See 
Table 13 for a complete decoding of these signals. The 
Byte Enables are active Low and will float during Bus 
Hold Acknowledge. 


Bus Cycle Definition Signals (W/R, D/c, M/o, 
LOCK) 


These three-state outputs define the type of bus cycle 
being performed: W/R distinguishes between write and 
read cycles; D/C distinguishes between data and 
control cycles; M/IO distinguishes between memory and 
/O cycles; and, LOCK distinguishes between locked 
and unlocked bus cycles. All of these signals are active 
Low and will float during Bus Acknowledge. 





The primary bus cycle definition signals are W/R, D/C, 
and M/IO, since these are the signals driven valid as 
ADS (Address Status output) becomes active. The 
LOCK is driven valid at the same time the bus cycle be- 
gins, which, due to address pipelining, could be after 
ADS becomes active. Exact bus cycle definitions, as a 
function of W/R, D/C, and M/IO, are given in Table 14. 


Table 13. Byte Enable Definitions 


Word Transfer 
Byte transfer on upper byte 


of the data bus, D15—D8 


Byte transfer on lower byte 
of the data bus, D7—DO 


Never occurs 





LOCK indicates that other system bus masters are not 
to gain control of the system bus while it is active. LOCK 
is activated on the CLK2 edge that begins the first 
locked bus cycle (i.e., it is not active at the same time as 
the other bus cycle definition pins) and is deactivated 
when READY is returned at the end of the last bus cycle 
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Table 14. Bus Cycle Definition 





Halt: 
Address = 2 


BHE = 1 
BLE =0 


Memory Data Read Some Cycles 





which is to be locked. The beginning of a bus cycle is 
determined when READY is returned in a previous bus 
cycle and another is pending (ADS is active), or the 
clock in which ADS is driven active if the bus was idle. 
This means that it follows more closely with the write 
data rules when it is valid, but may cause the bus to 
be locked longer than desired. The LOCK signal may 
be explicitly activated by the LOCK prefix on certain 
instructions. 





LOCK is always asserted when executing the XCHG 
instruction, during descriptor updates, and during the 
interrupt acknowledge sequence. 


Bus Control Signals (ADS, READY, NA) 


The following signals allow the processor to indicate 
when a bus cycle has begun, and allow other system 
hardware to control address pipelining and bus cycle 
termination. 


Address Status (ADS) 
This three-state output indicates that a valid bus cycle 


definition and address (W/R, D/C, M/IO, BHE, BLE, and 
A23-—A\1) are being driven at the Am386SX/SXL micro- 
processor pins. ADS is an active Low output. Once ADS 
is driven active, valid address, Byte Enables, and defini- 
tion signals will not change. In addition, ADS will remain 
active until its associated bus cycle begins (when 
READY is returned for the previous bus cycle when 
running pipelined bus cycles). When address pipe- 
lining is utilized, maximum throughput is achieved by 
initiating bus cycles when ADS and READY are active in 
the same clock cycle. ADS will float during Bus Hold 
Acknowledge. See sections Non-Pipelined Address 
and Pipelined Address for additional information on how 
ADS is asserted for different bus states. 





Interrupt Acknowledge 


Bus Cycle Type 


a 
| No | 





Shutdown: | 
Address = 0 


BLE =0 


Transfer Acknowledge (READY) 


This input indicates the current bus cycle is complete, 
and the active bytes indicated by BHE and BLE are 
accepted or provided. When READY is sampled active 
during a read cycle or interrupt acknowledge cycle, the 
Am386SX/SXL microprocessor latches the input data 
and terminates the cycle. When READY is sampled 
active during a write cycle, the processor terminates the 
bus cycle. 








READY is ignored on the first bus state of all bus cycles, 
and sampled each bus state thereafter until asserted. 
READY must eventually be asserted to acknowledge 
every bus cycle, including Halt Indication and Shutdown 
Indication bus cycles. When being sampled, READY 
must always meet setup and hold times (t19 and t20) 
for correct operation. 


Next Address Request (NA) 


This is used to request address pipelining. This input 
indicates the system is prepared to accept new values 
of BHE, BLE, A23-A1, W/R, D/C, and M/IO from the 
Am386SX/SXL CPU even if the end of the current cycle 
is not being acknowledged on READY. If this input is 
active when sampled, the next address is driven onto 
the bus, provided the next bus request is already 
pending internally. NA is ignored in CLK cycles in which 
ADS or READY is activated. This signal is active Low 
and must satisfy setup and hold times (t15 and t16) for 
correct operation. See sections Read and Write Cycles 
and Pipelined Address for additional information. 


Bus Arbitration Signals (HOLD, HLDA) 


This section describes the mechanism by which the 
processor relinquishes control of its local buses when 
requested by another bus master device. See section 
Entering and Exiting Hold Acknowledge for additional 
information. 
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Bus Hold Request (HOLD) 


This input indicates some device other than the | 


Am386SX/SXL microprocessor requires bus master- 
ship. When control is granted, the Am386SX/SXL CPU 
floats A23—-A1, BHE, BLE, D15-D0, LOCK, M/IO, D/C, 
W/R, and ADS, and then activates HLDA, thus entering 
the Bus Hold Acknowledge state. The local bus will 
remain granted to the requesting master until HOLD 
becomes inactive. When HOLD becomes inactive, the 
Am386SX/SXL microprocessor will deactivate HLDA 
and drive the local bus (at the same time), thus 
terminating the Hold Acknowledge condition. 


HOLD must remain asserted as long as any other 
device is a local bus master. External pull-up resistors 
may be required when in the Hold Acknowledge (HLDA) 
state, since none of the Am3886SX/SXL microprocessor 
floated outputs have internal pull-up resistors. See sec- 
tion Resistor Recommendations for additional infor- 
mation. HOLD is not recognized while RESET is active. 
If RESET is asserted while HOLD is asserted, RESET 
has priority and places the bus into an idle state, rather 
than the Hold Acknowledge (high impedance) state. 


HOLD is a level-sensitive, active High, synchronous 
input. HOLD signals must always meet setup and hold 
times (t23 and t24) for correct operation. 


Bus Hold Acknowledge (HLDA) 


When active (High), this output indicates the Am386SX/ 
SXL microprocessor has relinquished control of its local 
bus in response to an asserted HOLD signal, and is in 
the Bus Hold Acknowledge state. 


The Bus Hold Acknowledge state offers near complete 
signal isolation. In the HLDA state is the only signal 
being driven by the Am386SX/SXL microprocessor. 
The other output or bidirectional signals (D15—D0, BHE, 
BLE, A23—A1, W/R, D/C, M/IO, LOCK, and ADS) are in 
a high-impedance state so the requesting bus master 
may control them. These pins remain Off throughout the 
time that HLDA remains active (see Table 15). Pull-up 
resistors may be desired on several signals to avoid 
spurious activity when no bus master is driving them. 
See section Resistor Recommendations for additional 
information. 


When the HOLD signal is made inactive, the Am386SX/ 
SXL microprocessor will deactivate HLDA and drive the 
bus. One rising edge on the NMI input is remembered 
for processing after the HOLD input is negated. 





Table 15. Output Pin State During HOLD 


| PinVaue | PinNames 


1 HLDA 


Float LOCK, MAO, D/C, WAR, 
A23—A1, BHE, BLE, D15— 









i. 
29 


In addition to the normal usage of Hold Acknowledge 
with DMA controllers or master peripherals, the near 
complete isolation has particular attractiveness during 


system test when test equipment drives the system, and 
in hardware fault-tolerant applications. 


HOLD Latencies 


The maximum possible HOLD latency depends on the 
software being executed. The actual HOLD latency at 
any time depends on the current bus activity, the state of 
the LOCK signal (internal to the CPU) activated by the 
LOCK prefix, and interrupts. The Am386SX/SXL micro- 
processor will not honor a HOLD request until the 
current bus operation is complete. 


The Am3886SX/SXL microprocessor breaks 32-bit data 
or I/O accesses into 2 internally locked 16-bit bus 
cycles; the LOCK signal is not asserted. The Am386SX/ 
SXL microprocessor breaks unaligned 16-bit or 32-bit 
data or I/O accesses into 2 or 3 internally locked 16-bit 
bus cycles. Again, the LOCK signal is not asserted but a 
HOLD request will not be recognized until the end of the 
entire transfer. 


Wait states affect HOLD latency. The Am386SX/SXL 
microprocessor will not honor a HOLD request until the 
end of the current bus operation, no matter how many 
wait states are required. Systems with DMA where data 
transfer is critical must insure that READY returns 
promptly. 











Coprocessor Interface Signals (PEREQ, BUSY, 
ERROR) 


In the following sections are descriptions of signals 
dedicated to the math coprocessor interface. In addition 
to the data bus, address bus, and bus cycle definition 
signals, the following signals control communication 
between the Am386SX/SXL microprocessor and its 
387SX math coprocessor extension. 


Coprocessor Request (PEREQ) 


When asserted (High), this input signal indicates a 
coprocessor request for a data operand to be 
transferred to/from memory by the Am386SX/SXL Mi- 
croprocessor. In response, the Am386SX/SXL micro- 
processor transfers information between the math 
coprocessor and memory. Because the Am386SX/SXL 
CPU has internally stored the math coprocessor op- 
code being executed, it performs the requested data 
transfer with the correct direction and memory address. 


PEREQ is level-sensitive active High asynchronous 
signal. Setup and hold times (t29 and t30) relative to 
the CLK2 signal must be met to guarantee recognition 
at a particular clock edge. This signal is provided with a 
weak internal pull-down resistor of around 20 Kohms to 
Ground so that it will not float active when left 
unconnected. 


Coprocessor Busy (BUSY) 


When asserted Low, this input indicates that the 
coprocessor is still executing an instruction, and is not 
yet able to accept another. Whenthe Am386SX/SXL mi- 
croprocessor encounters any coprocessor instruction 
which operates on the numerics stack (e.g., load, pop, 
or arithmetic operation), or the WAIT instruction, this 
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input is first automatically sampled until it is seen to be 
inactive. This sampling of the BUSY input prevents 
overrunning the execution of a previous coprocessor 
instruction. 


The FNINIT, FNSTENV, FNSAVE, FNSTSW, 
FNSTCW, and FNCLEX coprocessor instructions are 
allowed to execute even if BUSY is active, since these 
instructions are used for coprocessor initialization and 
exception-clearing. 








BUSY is an active Low, level-sensitive, asynchronous 
signal. Setup and hold times (t29 and t30), relative to 
the CLK2 signal, must be met to guarantee recognition 
at a particular clock edge. This pin is provided with 
a weak internal pull-up resistor of around 20 Kohms to 
Vee SO that it will not float active when left unconnected. 


BUSY serves an additional function. If BUSY is sampled 
Low at the falling edge of RESET, the Am386SX/SXL 
microprocessor performs an internal self-test (see sec- 
tion Bus Activity During and Following Reset). If BUSY is 
sampled High, no self-test is performed. 


Coprocessor Error (ERROR) 


When asserted Low, this input signal indicates that 
the previous coprocessor instruction generated a 
coprocessor error of a type not masked by the 
coprocessor’s control register. This input is auto- 
matically sampled by the Am386SX/SXL microproces- 
sor when a coprocessor instruction is encountered, and 
if active, the Am386SX/SXL CPU generates Exception 
16 to access the error-handling software. 


Several coprocessor instructions, generally those which 
clear the numeric error flags in the coprocessor or save 
coprocessor state, do execute without the Am386SX/ 
SXL CPU generating Exception 16 even if ERROR is 
active. These instructions are FNINIT, FNCLEX, 
FNSTSW, FNSTSWAX, FNSTCW, FNSTENV, and 
FNSAVE. 


ERROR is an active Low, level-sensitive, asynchronous 
signal. Setup and hold times (t29 and t30), relative to 
the CLK2 signal, must be met to guarantee recognition 
at a particular clock edge. This pin is provided with a 
weak internal pull-up resistor of around 20 Kohms to Vec 
so that it will not float active when left unconnected. 


Interrupt Signals (INTR, NMI, RESET) 


The following descriptions cover inputs that can 
interrupt or suspend execution of the processor's 
current instruction stream. 


Maskable Interrupt Request (INTR) 


When asserted, this input indicates a request for 
interrupt service, which can be masked by the 
Am386SX/SXL microprocessor Flag Register IF bit. 
Whenthe Am386SX/SXL CPU responds to the INTR in- 
put, it performs two interrupt acknowledge bus cycles 
and, at the end of the second, latches an 8-bit interrupt 
vector on D7—D0 to identify the source of the interrupt. 
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INTR is an active High, level-sensitive, asynchronous 
signal. Setup and hold times (t27 and t28), relative to 
the CLK2 signal, must be met to guarantee recognition 
at a particular clock edge. To assure recognition of an 
INTR request, INTR should remain active until the first 
interrupt acknowledge bus cycle begins. INTR is 
sampled at the beginning of every instruction in the 
Am386SX/SXL microprocessor’s Execution Unit. In 
order to be recognized at a particular instruction 
boundary, INTR must be active at least eight CLK2 clock 
periods before the beginning of the instruction. if 
recognized, the Am886SX/SXL CPU will begin 
execution of the interrupt. 


Non-Maskable Interrupt Request (NMI) 


This input indicates a request for interrupt service which 
cannot be masked by software. The non-maskable 
interrupt request is always processed according to the 
pointer or gate in slot 2 of the interrupt table. Because of 
the fixed NMI slot assignment, no interrupt acknowledge 
cycles are performed when processing NMI. 


NMI is an active High, rising edge-sensitive, asyn- 
chronous signal. Setup and hold times (t27 and t28), 
relative to the CLK2 signal, must be met to guarantee 
recognition at a particular clock edge. To assure 
recognition of NMI, it must be inactive for at least eight 
CLK2 periods, and thenbe active for at least eight CLK2 
periods before the beginning of the instruction boundary 
in the Am386SX/SXL microprocessor’s Execution Unit. 


Once NMI processing has begun, no additional NMI’s 
are processed until after the next IRET instruction, 
which is typically the end of the NMI service routine. If 
NMI is re-asserted prior to that time, however, one rising 
edge on NMI will be remembered for processing after 
executing the next IRET instruction. 


Interrupt Latency 


The time that elapses before an interrupt request is 
serviced (interrupt latency) varies according to several 
factors. This delay must be taken into account by the 
interrupt source. Any of the following factors can affect 
interrupt latency: 


1. If interrupts are masked, an INTR request will not be 
recognized until interrupts are re-enabled. 


2. If an NMI is currently being serviced, an incoming 
NMI request will not be recognized until the 
Am386SX/SXL microprocessor encounters the 
IRET instruction. 


3. An interrupt request is recognized only on an in- 
struction boundary of the Am386SX/SXL 
microprocessors Execution Unit except for the 
following cases: 


— Repeat string instructions can be interrupted after 
each iteration. 


—lf the instruction loads the Stack Segment 
register, an interrupt is not processed until after 
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the following instruction, which should be an ESP. 
This allows the entire stack pointer to be loaded 
without interruption. 


— If an instruction sets the interrupt flag (enabling 
interrupts), an interrupt is not processed until after 
the next instruction. 


The longest latency occurs when the interrupt 
request arrives while the Am386SX/SXL micropro- 
cessor is executing a long instruction such as 
multiplication, division, or a task switch in the Pro- 
tected Mode. : 


4. Saving the Flags register and CS:EIP registers. 


5. If interrupt service routine requires a task switch, 
time must be allowed for the task switch. 


6. If the interrupt service routine saves registers 
that are not automatically saved by the Am386SX/ 
SXL microprocessor. 


Reset 


This input signal suspends any operation in progress 
and places the Am386SX/SXL microprocessor in a 
known reset state. The Am386SX/SXL CPU is reset by 
asserting RESET for 15 or more CLK2 periods (80 or 
more CLK2 periods before requesting self-test). When 
RESET is active, all other input pins, except FLT, are 
ignored, and all other bus pins are driven to an Idle Bus 
state, as shown in Table 16. If RESET and HOLD are 
both active at a point in time, RESET takes priority even 
if the AmM386SX/SXL microprocessor was in a Hold Ac- 
knowledge state prior to RESET active. 


Reset is an active High, level-sensitive, synchronous 
signal. Setup and hold times (t25 and t26) must be met 
in order to assure proper operation of the Am386SX/ 
SXL microprocessor. 


Bus Transfer Mechanism 


All data transfers occur as a result of one or more bus 
cycles. Logical data operands of byte and word lengths 
may be transferred without restrictions on physical 
address alignment. Any byte boundary may be used, 
although two physical bus cycles are performed as 
required for unaligned operand transfers. 


The Am886SX/SXL microprocessor address signals 
are designed to simplify external system hardware. 
Higher-order address bits are provided by A23—A1. 
BHE and BLE provide linear selects for the two bytes of 
the 16-bit data bus. 


Byte Enable outputs BHE and BLE are asserted when 
their associated data bus bytes are involved with the 
present bus cycle, as listed in Table 17. 


Each bus cycle is composed of at least two bus states. 
Each bus state requires one processor clock period. 
Additional bus states added to a single bus cycle are 
called wait states. See section Bus Functional 
Description. 


Table 16. Pin State (Bus Idle) During Reset 
| PinName | Signal Level During Reset | 
ADS 1 


D15—D0 
BHE, BLE 
A23-A1 


W/R 
D/C 
M/A 
LOCK 
HLDA 





Table 17. Byte Enables and Associated 
Data and Operand Bytes 


| Byte Enable Signal} Associated Data Bus Signals | 


D7—DO (Byte 0O—least significant) 
D15—D8 (Byte 1—most significant) 





Memory and I/O Spaces 


Bus cycles may access physical memory space or I/O 
space. Peripheral devices in the system may either be 
memory-mapped, |/O-mapped, or both. As shown in 
Figure 24, physical memory addresses range from 
000000H to OFFFFFFH (16 Mb) and I/O addresses from 
000000H to OOFFFFH (64 Kb). Note the I/O addresses 
used by the automatic I/O cycles for coprocessor 
communication are 8000F8H to 8000FFH, beyond the 
address range of programmed |/O, to allow easy 
generation of a coprocessor chip select signal using the 
A23 and M/IO signals. 


Bus Functional Description 


The Am386SX/SXL microprocessor has separate, par- 
allel buses for data and address. The data bus is 16-bits | 
in width, and bidirectional. The address bus provides a 
24-bit value using 23 signals for the 23 upper-order 
address bits and 23 Byte Enable signals to directly indi- 
cate the active bytes. These buses are interpreted and 
controlled by several definition signals. 
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FFFFFFH | 


ot 
Accessible “ss 


Physical Memory 8000FFH ree 


rome | s00ureH [<1 coprocessor 


OOFFFFH |. 





Accessible 
000000H 000000H Programmed 
/(O Space 


Physical Memory Space I/O Space 


Note: Since A23 is ig during automatic communication with coprocessor, A23 High and M/IO Low can be used to easily generate a 
coprocessor select signal. 
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Figure 24. Physical Memory and I/O Spaces 


Cycle 1 Cycle 2 | Cycle 3 
Non-Pipelined | Non-Pipelined Non-Pipelined 
(Read) | _ (Read) (Read) 


T1 Tt | vi | 2 | 1 | Te 


01 | 62 o1 | o2 | 01 | 02 o1 02] o1 | 62] ot] o2] of 

CLK2 | | 

(Input) 

BHE, BLE, A23-A1, 
AO, D/C, W/R 
(Output) 


ADS 
(Output) 


(Input) 





READY 
(Input) 


LOCK 
(Output) 


D15—D0O 
(Input during Read) 


Fastest non-pipelined bus cycles consist of T1 and T2 
15022B-013 


Figure 25. Fastest Read Cycles with Non-Pipelined Address Timing 
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The definition of each bus cycle is given by three 
signals: M/IO, W/R, and D/C. At the same time, a valid 
address is present on the Byte Enable signals, BHE 
and BLE, and the other address signals, A23—-A1. A 
status signal, ADS, indicates when the Am386SX/SXL 
microprocessor issues a new bus cycle definition and 
address. 


Collectively, the address bus, data bus, and all assoc- 
iated control signals are referred to simply as the bus. 
When active, the bus performs one of the bus cycles 
below: 


1. Read from memory space; 

Locked read from memory space; 

Write to memory space; 

Locked write to memory space; 

Read from I/O space (or math coprocessor); 
Write to I/O space (or math coprocessor); 
Interrupt acknowledge (always locked); 
Indicate halt, or indicate shutdown. 


ead et aca ee 


Table 14 shows the encoding of the bus cycle definition 
signals for each bus cycle. See section Bus Cycle Defi- 
nition Signals for additional information. 


When the Am386SX/SXL microprocessor bus is not 
per-forming one of the activities listed above, it is either 
idle or in the Hold Acknowledge state, which may be 
detected externally. The idle state can be identified by 
the Am386SX/SXL CPU giving no further assertions on 
its address strobe output (ADS) since the beginning of 
its most recent cycle, and the most recent bus cycle 
having been terminated. The Hold Acknowledge state is 
identified by the Am386SX/SXL microprocessor assert- 
ing its Hold Acknowledge (HLDA) output. 


Bus Functional Description 


The Am386SX/SXL microprocessor has _ separate, 
parallel buses for data and address. The data bus is 
16-bits in width, and bidirectional. The address bus 
provides a 24-bit value using 23 signals for the 23 
upper-order address bits and 2 Byte Enable signals to 
directly indicate the active bytes. These buses are 
interpreted and controlled by several definition signals. 


Cycle 1 Cycle 2 Cycle 3 
Pipelined Pipelined Pipelined 
(Read) (Read) (Read) 
T1P , T2P T1P T2P | T1P T2P 
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BHE, BLE, A23—A1, [ 
/iO, D/C, W/R 
(Outputs) 
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(Output) 
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(Output) 


D15—D0O [ 
(Input during Read) | 
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Fastest pipelined bus cycles consist of T1P and T2P 15022B-014 


Figure 26. Fastest Read Cycles with Pipelined Address Timing 
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The shortest time unit of bus activity is abus state. Abus 
state is one processor clock period (two CLK2 periods) 
in duration. A complete data transfer occurs during a 
bus cycle, composed of two or more bus states. 


The fastest Am3886SX/SXL microprocessor bus cycle 
requires only two bus states. For example, three 
consecutive bus read cycles, each consisting of two bus 
states, are shown in Figure 25. The bus states in each 
cycle are named T1 and T2. Any memory or I/O address 
may be accessed by such a two-state bus cycle, if the 
external hardware is fast enough. 


Every bus cycle continues until it is acknowledged by 
the external system hardware, using the AmM386SX/SXL 
microprocessor READY input. Acknowledging the bus 
cycle at the end of the first T2 results in the shortest bus 
cycle, requiring only T1 and T2. If READY is not 
immediately asserted however, T2 states are repeated 
indefinitely until the READY input is sampled active. 
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The address pipelining option provides a choice of bus 
cycle timings. Pipelined or non-pipelined address timing 
is selectable on a cycle-by-cycle basis with the Next 
Address (NA) input. 


When address pipelining is selected, the address (BHE, 
BLE, and A23-A1) and definition (W/R, D/C, M/IO, and 
LOCK) of the next cycle are available before the end of 
the current cycle. To signal their availability, the 
Am386SX/SXL microprocessor address status output 
(ADS) is asserted. Figure 26 illustrates the fastest read 
cycles with pipelined address timing. 


Note from Figure 26 the fastest bus cycles using 
pipelined address require only two bus states, named 
T1P and T2P. Therefore, cycles with pipelined address 
timing allow the same data bandwidth as non-pipelined 
cycles, but address-to-data access time is increased by 
one T-state time compared to that of a non-pipelined 
cycle. 























Idle Cycle 1 Cycle 2 Cycle 3 Idle Cycle 4 Idle 
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Note: Idle states are shown here for diagram variety only. Write cycles are not always followed by an idle state; an active bus cycle 
can immediately follow the write cycle. 
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Figure 27. Various Bus Cycles with Non-Pipelined Address (Zero Wait States) 


Am386SX/SXL Microprocessor Data Sheet 187 














al AMD 





Read and Write Cycles 


Data transfers occur as a result of bus cycles, classified 
as read or write cycles. During read cycles, data is 
transferred from an external device to the processor. 
During write cycles, data is transferred from the 
processor to an external device. 


Two choices of address timing are dynamically 
selectable: non-pipelined or pipelined. After an idle bus 
state, the processor always uses non-pipelined address 
timing. However, the NA (Next Address) input may be 
asserted to select pipelined address timing for the next 
bus cycle. When pipelining is selected and the 
Am386SX/SXL microprocessor has a bus request 
pending internally, the address and definition of the next 
cycle is made available even before the current bus 
cycle is acknowledged by READY. 





Terminating a read or write cycle, like any bus cycle, 
requires acknowledging the cycle by asserting the 
READY input. Until acknowledged, the processor 
inserts wait states into the bus cycle, to allow adjustment 











Idle Cycle 1 Cycle 2 Idle Cycle 3 Idle 
Non-Pipelined Non-Pipelined Non-Pipelined 
(Read) ee vee 
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Processor CLK L 
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forthe speed of any external device. External hardware, 
which has decoded the address and bus cycle type, 
asserts the READY input at the appropriate time. 





At the end of the second bus state within the bus cycle, 
READY is sampled. At that time, if external hardware 
acknowledges the bus cycle by asserting READY, the 
bus cycle terminates as shown in Figure 27. lf READY is 
negated, as in Figure 28, the Am3886SX/SXL micropro- 
cessor executes another bus state (a wait state) and 
READY is sampled again at the end of that state. This 
continues indefinitely until the cycle is acknowledged by 
READY asserted. 


When the current cycle is acknowledged, the 
Am386SX/SXL microprocessor terminates it. When a 
read cycle is acknowledged, the Am386SX/SXL CPU 
latches the information present at its data pins. When a 
write cycle is acknowledged, the Am386SX/SXL 
microprocessor’s write data remains valid throughout 
phase one of the next bus state, to provide write data 
hold time. 
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Note: Idle states are shown here for diagram variety only. Write cycles are not always followed by an idle state; an active bus cycle 


can immediately follow the write cycle. 
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Figure 28. Various Bus Cycles with Non-Pipelined Address (Various Number of Wait States) 
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Non-Pipelined Address 


Any bus cycle may be performed with non-pipelined 
address timing. For example, Figure 27 shows a mixture 
of read and write cycles with non-pipelined address 
timing. Figure 27 shows that the fastest possible cycles 
with non-pipelined address have two bus states per bus 
cycle. The states are named T1 and T2. In phase one of 
T1, the address signals and bus cycle definition signals 
are driven valid and, to signal their availability, address 
strobe (ADS) is simultaneously asserted. 


During read or write cycles the data bus behaves 
as follows. If the cycle is a read, the Am386SX/SXL mi- 
croprocessor floats its data signal to allow driving by the 
external device being addressed. The Am386SX/SXL 
microprocessor requires that all data bus pins be at a 
valid logic state (High or Low) at the end of each read 
cycle, when READY is asserted. The system must be 
designed to meet this requirement. If the cycle is a write, 
data signals are driven by the Am386SX/SXL CPU 
beginning in phase two of T1 until phase one of the bus 
state following cycle acknowledgment. 










HOLD Negated e No Request 


HOLD Asserted 
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Figure 28 illustrates non-pipelined bus cycles with one 
wait state added to Cycles 2 and 3. READY is sampled 
inactive at the end of the first T2 in Cycles 2 and 3. 
Therefore, Cycles 2 and 3 have T2 repeated again. At 
the end of the second T2, READY is sampled active. 








When address pipelining is not used, the address and 
bus cycle definition remain valid during all wait states. 
When wait states are added, and it is desirable to 
maintain non-pipelined address timing, itis necessary to 
negate NA during each T2 state, except the last one, as 
shown in Figure 28, Cycles 2 and 3. If NA is sampled 
active during a T2 other than the last one, the next state 
would be T2I or T2P instead of another T2. 


The bus states and transitions, when address pipelining 
is not used, are completely illustrated by Figure 29. The 
bus transitions between four possible states, T1, T2, Ti, 
and Th. Bus cycles consist of T1 and T2, with T2 being 
repeated for wait states. Otherwise the bus may be idle, 
Ti, or in the Hold Acknowledge state Th. 


HOLD Asserted 


READY Asserted e HOLD Asserted 


HOLD Negated e 
Request Pending 


READY Asserted e HOLD Negated e No Request 


HOLD Negated e 


No Request ” Request Pending 
HOLD Negated 
RESET 
Asserted 
Bus States: 


ALWAYS 


READY Asserted e 
HOLD Negated e 
Request Pending 








READY Negated e 
NA Negated 


T1— First clock of a non-pipelined bus cycle (Am386SX/SXL CPU drives new address and asserts ADS). 
T2— Subsequent clocks of a bus cycle when NA has not been sampled asserted in the current bus cycle. 


Ti — Idle state. 


Th— Hold Acknowledge state (Am386SX/SXL CPU asserts HLDA). 


The fastest bus cycle consists of two states: T1 and T2. 


Four basic bus states describe bus operation when not using pipelined address. 
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Figure 29. Bus States (Not Using Pipelined Address) 
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Bus cycles always begin with T1. T1 always leads to T2. 
If a bus cycle is not acknowledged during T2 and NA is 
inactive, T2 is repeated. When acycle is acknowledged 
during T2, the following state will be T1 of the next bus 
cycle, if a bus request is pending internally, or Ti, if there 
is no bus request pending, or Th, if the HOLD input is 
being asserted. 

Use of pipelined address allows the Am386SX/SXL mi- 
croprocessor to enter three additional bus states not 
shown in Figure 29. Figure 33 is the complete bus state 
diagram, including pipelined address cycles. 


Pipelined Address 


Address pipelining is the option of requesting the 
address and the bus cycle definition of the next 


internally pending bus cycle before the current bus 
cycle is acknowledged with READY asserted. ADS is 
asserted by the Am386SX/SXL microprocessor when 
the next address is issued. The address pipelining op- 
tion is controlled on a cycle-by-cycle basis with the NA 
input signal. 





Once a bus cycle is in progress and the current address 
has been valid for at least one entire bus state, the NA 
input is sampled at the end of every phase one until the 
bus cycle is acknowledged. During non-pipelined bus 
cycles, NA is sampled at the end of phase one in every 
T2. An example is Cycle 2 in Figure 30, during which 
NA is sampled at the end of phase one of every T2 
(it was asserted once during the first T2 and has no 
further effect during that bus cycle). 


Idle Cycle 1 Cycle 2 Cycle 3 Cycle 4 Idle 
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Note: Following any idle bus state (Ti), addresses are non-pipelined. Within non-pipelined bus cycles, NA is only sampled during 
wait states. Therefore, to begin address pipelining during a group of non-pipelined bus cycles requires a non-pipelined 


cycle with at least one wait state (Cycle 2 above). 
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Figure 30. Transitioning to Pipelined Address During Burst of Bus Cycles 
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If NA is sampled active, the Am386SX/SXL micropro- 
cessor is free to drive the address and bus cycle 
definition of the next bus cycle, and assert ADS, as soon 
as it has a bus request internally pending. It may drive 
the next address as early as the next bus state, whether 
the current bus cycle is acknowledged at that time or 
not. 


Regarding the details of address pipelining, the 
Am386SX/SXL CPU has the following characteristics: 


1. The next address may appear as early as the bus 
state after NA was sampled active (see Figures 30 
and 31). In that case, state T2P is entered immed- 
iately. However, when there is not an internal bus 
request already pending, the next address will not be 
available immediately after NA is asserted and T2l is 
entered instead of T2P (see Figure 32, Cycle 3). 


AMD al 


Provided the current bus cycle is not yet acknow- 
ledged by READY asserted, T2P will be entered as 
soon as the Am386SX/SXL microprocessor does 
drive the next address. External hardware should 
therefore observe the ADS output as confirmation 
the next address is actually being driven on the bus. 





. Any address which is validated by a pulse on the 


ADS output will remain stable on the address pins 
for at least two processor clock periods. The 
Am386SX/SXL CPU cannot produce a new address 
more frequently than every two processor clock 
periods (see Figures 30, 31, and 32). 


. Only the address and bus cycle definition of the very 


next bus cycle is available. The pipelining capability 
cannot look further than one bus cycle ahead (see 
Figure 32, Cycle 1). 
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Note: Following any idle bus state (Ti) the address is always non-pipelined and NA is only sampled during wait states. To start 
address pipelining after an idle state requires a non-pipelined cycle with at least one wait state (Cycle 1 above). The 
pipelined cycles (2, 3, and 4 above) are shown with various numbers of wait states. 
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Figure 31. Fastest Transition to Pipelined Address Following Idle Bus State 
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The complete bus state transition diagram, including The fastest bus cycle with pipelined address consists of 
operation with pipelined address, is given in Figure 33. just two bus states, T1P and T2P (recall for non- 
Note that it is a superset of the diagram for non-pipelined pipelined address it is T1 and T2). T1P is the first bus 
address only, and the three additional bus states for state of a pipelined cycle. 

pipelined address are drawn in bold. 
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Figure 32. Details of Address Pipelining During Cycles with Wait States 
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Bus States: 

T1 — First clock of a non-pipelined bus cycle (Am386SX/SXL CPU drives new 
address and asserts ADS). 

T2 — Subsequent clocks of a bus cycle when NA has not been sampled asserted 
in the current bus cycle. 

T2I|— Subsequent clocks of a bus cycle when NA has been sampled asserted in 
the current bus cycle but there is not yet an internal bus request pending 
(Am386SX/SXL CPU will not drive new address or assert ADS). 

T2P—Subsequent clocks of a bus cycle when NA has been sampled asserted in 
the current bus cycle and there is an internal bus request pending 
(Am386SX/SXL CPU drives new address and asserts ADS). 

T1P—First clock of a pipelined bus cycle. 

Ti — Idle state. 

Th — Hold Acknowledge state (Am386SX/SXL CPU asserts HLDA). 


Asserting NA for pipelined address gives access to three more bus states: T2l, 
T2P, and T1P. 


Using pipelined address, the fastest bus cycle consists of T1P and T2P. 
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Figure 33. Compiete Bus States (including Pipelined Address) 
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Initiating and Maintaining Pipelined Address 


‘Using the state diagram Figure 33, observe the 
transitions from an idle state (Ti) to the beginning of a 
pipelined bus cycle (T1P). From an idle state (Ti) the first 
bus cycle must begin with T1, and is therefore a 
non-pipelined bus cycle. The next bus cycle will be 
pipelined, however, provided NA is asserted and the 
first bus cycle ends in a T2P state (the address for the 
next bus cycle is driven during T2P). The fastest path 
from an idle state to a bus cycle with pipelined address is 
shown in bold below: 


Ti, Ti, Ti, T1-—T2—T2P, T1P—T2P, 


Idle Non-Pipelined Pipelined 
States Cycle Cycle 


T1-T2-T2P are the states of the bus cycle that establish 
address pipelining for the next bus cycle, which begins 
with T1P. The same is true after a bus hold state, shown 
below: 


Th, Th, Th, T1-T2-T2P, T1P-T2P, 


Hold Acknowledge Non-Pipelined Pipelined 
States Cycle Cycle 


The transition to pipelined address is shown functionally 
by Figure 31, Cycle 1. Note that Cycle 1 is used to 
transition into pipelined address timing for the 
subsequent Cycles 2, 3, and 4, which are pipelined. The 
NA input is asserted at the appropriate time to select 
address pipelining for Cycle 2, 3, and 4. 


Once abus cycle is in progress and the current address 
has been valid for one entire bus state, the NA input is 
sampled at the end of every phase one until the bus 
cycle is acknowledged. Sampling begins in T2 during 
Cycle 1 in Figure 31. Once NA is sampled active during 
the current cycle, the Am386SX/SXL microprocessor is 
free to drive a new address and bus cycle definition on 
the bus as early as the next bus state. In Figure 31, Cy- 
cle 1 for example, the next address is driven during state 
T2P. Thus, Cycle 1 makes the transition to pipelined 
address timing, since it begins with T1 but ends with 
T2P. Because the address for Cycle 2 is available 
before Cycle 2 begins, Cycle 2 is called a pipelined bus 
cycle, and it begins with T1P. Cycle 2 begins as soon as 
READY asserted terminates Cycle 1. 


Examples of transition bus cycles are Figure 31, Cycle 1 
and Figure 30, Cycle 2. Figure 31 shows transition 
during the very first cycle after an idle bus state, which is 
the fastest possible transition into address pipelining. 
Figure 30, Cycle 2 shows a transition cycle occurring 
during a burst of bus cycles. In any case, a transition 
cycle is the same whenever it occurs: it consists at least 
of T1, T2 (NA is asserted at that time), and T2P 
(provided the Am386SX/SXL microprocessor has an 
internal bus request already pending, which it almost 
always has). T2P states are repeated if wait states are 
added to the cycle. 


Note that only three states (T1, T2, and T2P) are 
required in a bus cycle performing a transition from 


non-pipelined address into pipelined address timing 
(e.g., Figure 31, Cycle 1). Figure 31, Cycles 2, 3, and 4 
show that address pipelining can be maintained with 
two-state bus cycles consisting only of T1P and T2P. 


Once a pipelined bus cycle is in progress, pipelined 
timing is maintained for the next cycle by asserting NA 
and detecting that the Am386SX/SXL microprocessor 
enters T2P during the current bus cycle. The current bus 
cycle must end in state T2P for pipelining to be main- 
tained in the next cycle. T2P is identified by the assertion 
of ADS. Figures 30 and 31, however, each show pipelin- 
ing ending after Cycle 4, because Cycle 4 ends in T2l. 
This indicates the Am386SX/SXL CPU did not have an 
internal bus request prior to the acknowledgment of 
Cycle 4. if a cycle ends with a T2 or T2i, the next cycle 
will not be pipelined. 


Realistically, address pipelining is almost always 
maintained as long as NA is sampled asserted. This is 
so because in the absence of any other request, a code 
prefetch request is always internally pending until the 
instruction decoder and code prefetch queue are 
completely full. Therefore, address pipelining is main- 
tained for long bursts of bus cycles, ifthe bus is available 
(i.e., HOLD inactive), and NA is sampled active in each 
of the bus cycles. 


interrupt Acknowledge (INTA) Cycles 


In response to an interrupt request on the INTR input 
when interrupts are enabled, the Am386SX/SXL micro- 
processor performs two interrupt acknowledge cycles. 
These bus cycles are similar to read cycles in that bus 
definition signals define the type of bus activity taking 
place, and each cycle continues until acknowledged by 





READY sampled active. 


The state of A2 distinguishes the first and second 
interrupt acknowledge cycles. The byte address driven 
during the first interrupt acknowledge cycle is 4 
(A23-A3, A1, BLE Low, A2 and BHE High). The byte 
address driven during the second interrupt acknow- 
ledge cycle is 0 (A23-A1, BLE Low, and BHE High). 


The LOCK output is asserted from the beginning of 
the first interrupt acknowledge cycle until the end of 
the second interrupt acknowledge cycle. Four idle bus 
states (Ti) are inserted by the Am386SX/SXL micropro- 
cessor between the two interrupt acknowledge cycles 
for compatibility with soec TRHRL of the 8259A Interrupt 
Controller. 


During both interrupt acknowledge cycles, D15—D0O 
float. No data is read at the end of the first interrupt 
acknowledge cycle. At the end of the second interrupt 
acknowledge cycle, the Am386SX/SXL microprocessor 
will read an external interrupt vector from D7—D0O of the 
data bus. The vector indicates the specific interrupt 
number (from 0-255) requiring service. 


Halt Indication Cycle 


The execution unit halts as a result of executing a HLT 
instruction. Signaling its entrance into the halt state, a 
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halt indication cycle is performed. The halt indication 
cycle is identified by the state of the bus definition 
signals shown onpage 39, Bus Cycle Definition Signals, 
and an address of 2. The halt indication cycle must 
be acknowledged by READY asserted. A halted 
Am386SX/SXL CPU resumes execution when INTR (if 
interrupts are enabled), NMI, or RESET is asserted. 





Shutdown Indication Cycle 


The Am386SX/SXL microprocessor shuts down as a 
result of a protection fault while attempting to process a 
double fault. Signaling its entrance into the shutdown 
state, a shutdown indication cycle is performed. The 
shutdown indication cycle is identified by the state of the 
bus definition signals shown in section Bus Cycle 





Previous Interrupt 
Cycle Acknowledge 
Cycle 1 
T2 TI T2 T2 Ti 


CLK2 i 
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Definition Signals and an address of 0. The shutdown 
indication cycle must be acknowledged by READY as- 
serted. A shut-down Am386SX/SXL microprocessor 
resumes execution when NMI or RESET is asserted. 





Entering and Exiting Hold Acknowledge 


The Bus Hold Acknowledge state (Th) is entered in 
response to the HOLD input being asserted. In the Bus 
Hold Acknowledge state, the Am386SX/SXL micropro- 
cessor floats all outputs or bidirectional signals, except 
for HLDA. HLDA is asserted as long as the Am386SX/ 
SXL CPU remains in the Bus Hold Acknowledge state. 
In the Bus Hold Acknowledge state, all inputs except 
HOLD, FLT, and RESET are ignored. 
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Interrupt Vector (0-255) is read on D7—DO at end of second Interrupt Acknowledge bus cycle. Because each Interrupt Acknowledge bus cycle is 
followed by idle bus states, asserting NA has no practical effect. Choose the approach which is simplest for your system hardware design. 
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Figure 34. Interrupt Acknowledge Cycles 
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Th may be entered from a bus idle state, as in Figure 37, 
or after the acknowledgment of the current physical bus 
cycle, if the LOCK signal is not asserted, as in Figures 
38 and 39. 


Th is exited in response to the HOLD input being 
negated. The following state will be Ti if no bus request 
is pending, as in Figure 37. The following bus state will 
be T1 ifa bus request is internally pending, as in Figures 
38 and 39. Th is exited in response to RESET being 
asserted. 





If a rising edge occurs on the edge-triggered NMI in- 
put while in Th, the event is remembered as a non- 
maskable interrupt 2 and is serviced when Th is exited, 
unless the Am386SX/SXL microprocessor is reset 
before Th is exited. 


Reset During Hold Acknowledge 


RESET being asserted takes priority over HOLD being 
asserted. If RESET is asserted while HOLD remains 
asserted, the Am386SX/SXL microprocessor drives its 
pins to defined states during reset, as in Table 16 (Pin 
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State During Reset), and performs internal reset activity 
as usual. 


If HOLD remains asserted when RESET is inactive, the 
Am386SX/SXL CPU enters the Hold Acknowledge 
state before performing its first bus cycle, provided 
HOLD is still asserted when the Am386SX/SXL micro- 
processor would otherwise perform its first bus cycle. 


FLOAT 


Activating the FLT input floats all Am386SX/SXL micro- 
processor bidirectional and output signals, including 
HLDA. Asserting FLT isolates the Am386SX/SXL mi- 
croprocessor from the surrounding circuitry. 


As the Am386SX/SXL microprocessor is packaged ina 
surface mount PQFP, it cannot be removed from the 
motherboard when In-Circuit Emulation (ICE) is 
needed. The FLT input allows the Am386SX/SXL CPU 
to be electrically isolated from the surrounding circuitry. 
This allows connection of an emulator to the Am386SX/ 
SXL microprocessor PQFP without removing it from the 
PCB. This method of emulation is referred to as ON- 
Circuit Emulation (ONCE). 


Idle 


Am386SX/SXL CPU remains halted 
until INTR, NMI, or RESET is as- 


asa 
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Am386SX/SXL CPU responds to 
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Figure 35. Example Halt Indication Cycle from Non-Pipelined Cycle 
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Entering and Exiting FLOAT 


FLT is an asynchronous, active Low input. It is recog- 
nized on the rising edge of CLK2. When recognized, it 
aborts the current bus cycle and floats the outputs of 
the Am386SX/SXL microprocessor (Figure 41). FLT 
must be held Low for a minimum of 16-CLK2 cycles. 
Reset should be asserted and held asserted until after 
FLT is deasserted. This will ensure that the Am386SX/ 
SXL CPU will exit FLOAT in a valid state. 


Asserting the FLT input unconditionally aborts the 
current bus cycle and forces the Am386SX/SXL CPU 
into the FLOAT mode. Since activating FLT 
unconditionally forces the Am386SX/SXL CPU into 
FLOAT mode, the Am386SX/SXL microprocessor is not 
guaranteed to enter FLOAT in a valid state. After 
deactivating FLT, the Am386SX/SXL CPU is not 
guaranteed to exit FLOAT mode in a valid state. This is 
not a problem, as the FLT pin is meant to be used only 
during ONCE. After exiting FLOAT, the Am386SX/SXL 
microprocessor must be reset to return it to a valid state. 
Reset should be asserted before FLT is deasserted. 
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This will ensure that the AmM386SX/SXL CPU will exit 
FLOAT in a valid state. 


FLT has an internal pull-up resistor, and if it is not used it 
should be unconnected. 


Bus Activity During and Following Reset 


RESET is the highest priority input signal, capable of 
interrupting any processor activity when it is asserted. 
A bus cycle in progress can be aborted at any stage, or 
idle states and Bus Hold Acknowledge states discon- 
tinued, so that the reset state is established. 


RESET should remain asserted for at least 15-CLK2 
periods to ensure it is recognized throughout the 
Am386SX/SXL microprocessor, and at least 80-CLK2 
periods if self-test is going to be requested at the falling 
edge. RESET asserted pulses less than 15-CLK2 
periods may not be recognized. RESET pulses less 
than 80-CLK2 periods followed by a self-test may cause 
the self-test to report a failure when no true failure 
exists. 


Idle 





Am386SX/SXL CPU remains 
shutdown until NMI or RESET 
is asserted. 
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HOLD input while 
in the Shutdown 
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Figure 36. Example Shutdown Indication Cycle from Non-Pipelined Cycle 
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Provided the RESET falling edge meets setup and hold 
times (t25 and t26), the internal processor clock phase is 
defined at that time as illustrated by Figure 40 and 
Figure 48. 


A self-test may be requested at the time RESET goes 
inactive by having the BUSY input at a Low level, as 
shown in Figure 40. The self-test requires approxi- 
mately (22° + 60) CLK2 periods to complete. The self- 
test duration is not affected by the test results. Even 
if the self-test indicates a problem, the AmM386SX/SXL 
microprocessor attempts to proceed with the reset 
sequence afterwards. 


After the RESET falling edge (and after the self-test 
if it was requested), the Am386SX/SXL microprocessor 
performs an internal initialization sequence for approx- 
imately 350- to 450-CLK2 periods. 





Self-Test Signature 


Upon completion of self-test (if self-test was requested 
by driving BUSY Low at the falling edge of RESET) the 
EAX register will contain a signature of OO0Q0000H, 





| Idle | Hold Acknowledge | Idle 


CLK2 


Processor CLK 


HOLD 


HLDA 


BHE, BLE, 
A23-A1, M/O, 
D/C, W/R 


> 
~” 








indicating the Am386SX/SXL microprocessor passed 
its self-test of microcode and major PLA contents with 
no problems detected. The passing signature in EAX, 
00000000H, applies to all revision levels. Any non-zero 
signature indicates the unit is faulty. 


Component and Revision identifiers 


To assist users the Am886SX/SXL microprocessor, 
after reset, holds a component identifier and revision 
identifier in its DX register. The upper 8 bits of DX hold 
23H as identification of the Am386SX/SXL CPU (the 
lower nibble, 03H, refers to the Am386DX/DXL micro- 
processor architecture. The upper nibble, 02H, refers to 
the second member of the Am386DX/DXL microproces- 
sor Family). The lower 8 bits of DX hold an 8-bit 
unsigned binary number related to the component 
revision level. The revision identifier will, in general, 
chronologically track those component steppings which 
are intended to have certain improvements or distinction 
from previous steppings. The AmM386SX/SXL micropro- 
cessor revision identifier will track that of the Am386DX/ 
DXL CPU where possible. 





XAXXXXXXXEKKKXKXXXXXKK 


Note: For maximum design flexibility the Am386SX/SXL CPU has no internal pull-up resistors on its outputs. The design may re- 
quire an external pull-up on ADS and other outputs to keep them negated during float periods. 
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Figure 37. Requesting Hold from Idle Bus 
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Note: HOLD is a synchronous input and can be asserted at any CLK2 edge, provided setup and hold (t23 and t24) 
requirements are met. This waveform is useful for determining Hold Acknowledge latency. 
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Figure 38. Requesting Hold from Active Bus (NA Inactive) 
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Note: HOLD is a synchronous input and can be asserted at any CLK2 edge, provided setup and hold (t23 and t24) 
requirements are met. This waveform is useful for determining Hold Acknowledge latency. 
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Figure 39. Requesting Hold from Idle Bus (NA Active) 
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Figure 40. Bus Activity from Reset Until First Code Fetch 
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Figure 41. Entering and Exiting FLT 
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The revision identifier is intended to assist users to a 
practical extent. However, the revision identifier value is 
not guaranteed to change with every stepping revision, 
or to follow a completely uniform numerical sequence, 
depending on the type or intention of revision, or 
manufacturing materials required to be changed. 


Table 18. Component and Revision 
identifier History 














Am386SXL 





Intel i386SX Microprocessor 
Stepping Revision Revision Identifier 





B At 05H | 
Cc B | 08H | 


Coprocessor Interfacing 


The Am886SX/SXL microprocessor provides an 
automatic interface for a 387SX math coprocessor. A 
387SX math coprocessor uses an I/O mapped interface 
driven automatically by the Am386SX/SXL CPU and 
assisted by three dedicated signals: BUSY, ERROR, 
and PEREQ. 


As the Am386SX/SXL microprocessor begins 
supporting a math coprocessor instruction, it tests the 
BUSY and ERROR signals to determine if the copro- 
cessor can accept its next instruction. Thus, the BUSY 
and ERROR inputs eliminate the need for any preamble 
bus cycles for communication between processor and 
math coprocessor. A 387SX math coprocessor can be 
given its command op-code immediately. The dedicated 
signals provide instruction synchronization and elimi- 
nate the need of using the WAIT op-code (9BH) for 
387SX math coprocessor instruction synchronization 
(the WAIT opcode was required when the 8086 or 8088 
was used with the 8087 math coprocessor). 














Custom math coprocessors can be included in 
Am386SX/SXL microprocessor based systems by 
memory-mapped or I/O-mapped interfaces. Such math 
coprocessor interfaces allow a completely custom 
protocol, and are not limited to a set of math coproces- 
sor protocol primitives. Instead, memory-mapped or 
1/O-mapped interfaces may use all applicable instruc- 
tions for high-speed math coprocessor communication. 
The BUSY and ERROR inputs of the Am386SX/SXL mi- 
croprocessor may also be used for the custom math 
coprocessor interface, if such hardware assist is 
desired. These signals can be tested by the WAIT op- 
code (9BH). The WAIT instruction will wait until the 
BUSY input is inactive (interruptable by an NMI or 
enabled INTR input), but generates an Exception 16 
fault if the ERROR pin is active when the BUSY goes (or 
is) inactive. If the custom math coprocessor interface is 
memory-mapped, protection of the addresses used for 
the interface can be provided with the Am386SX/SXL 
CPU’s on-chip paging or segmentation mechanisms. If 











the custom interface is |/O-mapped, protection of the 
interface can be provided with the IOPL (I/O Privilege 
Level) mechanism. 


A 387SX math coprocessor interface is I/O mapped as 
shown in Table 19. Note that a387SX math coprocessor 
interface addresses are beyond the OH-OFFFFH range 
for programmed I/O. When the Am386SX/SXL micro- 
processor supports the 387SX math coprocessor, the 
Am386SX/SXL CPU automatically generates bus 
cycles to the coprocessor interface addresses. 










Table 19. Math Coprocessor Port Address 
| Address in AM386SXL | 387SX-Compatible Math | 
! CPU I/O Space Coprocessor Register | 
8000F8H Op-code Register 
8000FCH/8000FEH* | Operand Register 


*Generated as 2nd bus cycle during Dword transfer. 





To correctly map a 387SX math coprocessor registers 
to the appropriate I/O addresses, connect the CMDO 
and CMD1 lines of a 387SX math coprocessor, as 
listed in Table 20. 


Table 20. Connections for CMDO 
and CMD1 Inputs for a 387SX 




















| Signal Connection 


| CMDO | Connected directly to AM386SXL CPU A2 signal.| 
| CMD1 | Connect to ground. | 





Software Testing for Math Coprocessor Presence 


When software is used to test for math coprocessor 
(387SX) presence, it should use only the following math 
coprocessor op-codes: FINIT, FNINIT, FSTCW mem, 
FSTSW mem, and FSTSW AX. To use other math 
coprocessor op-codes when a math coprocessor is 
known to be not present, first set EM = 7 in the 
Am386SX/SXL CPU’s CRO register. 


PACKAGE THERMAL SPECIFICATIONS 


The Am386SX/SXL microprocessor is specified for 
operation when case temperature is within the range of 
0°C-—100°C. The case temperature may be measured in 
any environment to determine whether the Am386SX/ 
SXL CPU is within specified operating range. The case 
temperature should be measured atthe center of the top 
surface opposite the pins. 


The ambient temperature is guaranteed as long as Tc is 
not violated. The ambient temperature can be calcu- 
lated from the 8jc and 8ja from the following equations: 


Tj = Tc +P e6jc 
Ta = Tj-Pe@ja 
Te = Ta+P e[Oja— jc] 
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ELECTRICAL SPECIFICATIONS 


The following sections describe recommended electri- 
cal connections for the Am386SX/SXL microprocessor, 
and its electrical specifications. 


Power and Grounding 


The Am386SX/SXL CPU has modest power 
requirements. However, its high clock frequency and 47 
output buffers (address, data, control, and HLDA) can 
Cause power Surges as multiple output buffers drive new 
signal levels simultaneously. For clean on-chip power 
distribution at high frequency, 14 Vcc and 18 Vss pins 
separately feed functional units of the Am386SX/SXL 
microprocessor. 


Power and ground connections must be made to all 
external Vcc and Vss pins of the Am386SX/SXL micro- 
processor. On the circuit board, all Vcc pins should 
be connected on a Vcc plane, and Vss pins should be 
connected on a GND plane. 


Power Decoupling Recommendations 


Liberal decoupling capacitors should be placed near the 
Am386SX/SXL microprocessor. The Am386SX/SXL 
CPU driving its 24-bit address bus and 16-bit data bus at 
high frequencies can cause transient power surges, 
particularly when driving large capacitive loads. Low 
inductance capacitors and interconnects are recom- 
mended for best high frequency electrical performance. 
Inductance can be reduced by shortening circuit board 
traces between the Am386SX/SXL microprocessor and 
decoupling capacitors as much as possible. 


AMD cl 


Resistor Recommendations 


The ERROR, FLT, and BUSY inputs have internal pull- 
up resistors of approximately 20 Kohms, and the 
PEREQ input has an internal pull-down resistor of 
approximately 20 Kohms, built into the Am386SX/SXL 
microprocessor to keep these signals inactive when a 
387SX-compatible math coprocessor is not present in 
the system (or temporarily removed from its socket). 


In typical designs, the external pull-up resistors shown 
in Table 21 are recommended. However, a particular 
design may have reason to adjust the resistor values 
recommended here, or alter the use of pull-up resistors 
in other ways. 


Other Connection Recommendations 


For reliable operation, always connect unused inputs to 
an appropriate signal level. NC pins should always re- 
main unconnected. Connection of NC pins to Vccor Vss 
will result in component malfunction or incompatibility 
with future steppings of the Am386SX/SXL CPU. 


Particularly when not using the interrupts or bus hold (as 
when first prototyping), prevent any chance of spurious 
activity by connecting these associated inputs to GND. 


Pin Signal 
40 INTR 
38 NMI 

4 HOLD 


If not using address pipelining, connect pin 6 (NA) 
through a pull-up in the range of 20 Kohms to Vec. 


Table 21. Recommended Resistor Pull-Ups to Vcc 








ee piIeup vals [Purpose *d 


ADS 20 Kohms +10% Lightly pull ADS inactive during Am386SX/SXL 
CPU Hold Acknowledge states. 
TOGK 20 Kohms +10% | Lightly pull LOCK inactive during Am386SX/SXL_ | 
CPU Hold Acknowledge states. 
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ABSOLUTE MAXIMUM RATINGS 


Ambient Temperature under bias ..... —65 to 125°C. 


Storage Temperature .............. —65 to 150°C 


Stresses above those listed ma y cause permanent 
damage to the device. Exposure to absolute maximum 


OPERATING RANGES 
Supply Voltage with respect to Vss .... —0.5Vto7V 
Voltage onotherpins ........ —0.5 V to (Vee + 0.5)V 


Operating ranges define those limits between which the 
functionality of the device is guaranteed. 


rating conditions for extended per of time may affect 
device reliability. 
DC CHARACTERISTICS over COMMERCIAL operating ranges 


Voc =5 V+10%; Tcase = 0°C to +100°C (16, 20, 25, and 33 MHz) 
Vec=5 V +5%; Tcase = 0°C to +100°C (40 MHz) 


Vu | InputLow Voltage (Note ty) | 
I 
————————— 

































Fou Low Voltage 
lo. = 4 mA: A23-A1, D15—DO 0.45 V 
lo = 5 mA: BHE, BLE, W/R, 0.45 V 
D/C, MAO, LOCK, 
ADS, HLDA 
V 
V 
V 





Input Leakage Current (for all pins ex- | OV < Vin < Vec +15 | pA | 
| cept PEREQ, BUSY, FLT, and ERROR) il 
| Input Leakage Current (PEREQ pin) | Vin = 2.4 V (Note 2) ao es 
Input Leakage Current Vi. = 0.45 V (Note 3) — 400 pA 
(BUSY, ERROR, and FLT pins) | . 
Output Leakage Current 0.45 V < Vour < Vee [ats [oma | 


Supply Current 





Output High Voltage 

loo = 1.0mA: A23-A1, D15-D0O 

lon = 0.2 mA: A23—-A1, D15—D0 

lon = 0.9mA: BHE, BLE, W/R, 
D/C, MAO, LOCK, 
ADS, HLDA 

lon = 0.18 mA: BHE, BLE, W/R, 
D/C, MAO, LOCK, 
ADS, HLDA 





CLK2 = 32 MHz: with —16* = mA 
CLK2 = 40 MHz: with —20 = 155 mA 
CLK2 = 50 MHz: with —25 = 190 mA 
CLK2 = 66 MHz: with -33 = 245 ie 


CLK2 = 80 MHz: with —40 


2 ae anes Te | 
[ear | oop oriO capone [re =twe ny |_| tao 
[ean [ouecancine idee twee | mr 


5. Inputs at rails, outputs unloaded, PEREQ Low, ERROR High, 
USY High, and FLT High. 


Notes: Tested at the minimum operating frequency of the part. 
*Contact AMD for 16-MHz availability. 
1. The Min value, —0.3, is not 100% tested. 
2. PEREQ input has an internal pull-down resistor. 
3. BUSY, FLT, and ERROR inputs each have an internal 
pull-up resistor. 
4. Not 100% tested. 
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SWITCHING CHARACTERISTICS 


The switching characteristics given consist of output de- 
lays, input setup requirements, and input hold require- 
ments. All switching characteristics are relative to the 
CLK2 rising edge crossing the 2.0 V level. 


Switching characteristic measurement is defined by 
Figure 42. Inputs must be driven to the voltage levels 
indicated by Figure 42 when switching characteristics 
are measured. Output delays are specified with 
minimum and maximum limits measured, as shown. 
The minimum delay times are hold times provided to 
external circuitry. Input setup and hold times are 


CLK2 | 2V 


aoe 8) 
A23-A1, BHE, BLE, 7a 
ae =~ ~ all 
ADS, MiG, D/C, | Outputn 1-5-¥) 
WIR, LOCK, HLDA 
D15—Do | 
3.0V = 
NA, INTR, NMI | ees 
oy ste 


FLT, ERROR, BUSY, 


READY, HOLD, 
PEREQ, D15—D0O 


Legend: A—Maximum Output Delay Characteristic 
B— Minimum Output Delay Characteristic 


C—Minimum Input Setup Characteristic 
D— Minimum Input Hold Characteristic 









a RN ‘OV Output n+1 


Valid SP 


Output n 


AMD a\ 


specified as minimums, defining the smallest accept- 
able sampling window. Within the sampling window, a 
synchronous input signal must be stable for correct 
operation. 


Outputs ADS, W/R, D/C, M/lIO, LOCK, BHE, BLE, 
A23—-A1, and HLDA only change at the beginning of 
phase one. D15—D0 (write cycles) only change at the 
beginning of phase two. The READY, HOLD, BUSY, 
ERROR, PEREQ, FLT, and D15-D0 (read cycles) 
inputs are sampled at the beginning of phase one. The 
NA, INTR, and NMI inputs are sampled at the beginning 
of phase two. 


Tx 
02 





Valid 


SOA Valid 


‘ TN 5V Output n+1 








15022B-—030 


Figure 42. Drive Levels and Measurement Points for Switching Characteristics 
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SWITCHING CHARACTERISTICS over COMMERCIAL operating ranges 
Switching Characteristics at 40 MHz (Am386SX Microprocessor Only): Vcc = 5 V+5%; Tease = 0°C to 100°C 


Ref. 
Symbol| Parameter Description |e mene | atm _| tac | une 


|_| Operating Frequency | Half cuK2troquency ||| 4 | MH 
CLK2 Period feet ee ee ed 12.5 250 

CLK2 High Time 
CLK2 Low Time 
CLK2 Fall Time |27Vtoo8V  (Note3)| 44 
CLK2 Rise Time 


A23—A1 Valid Delay 
23-A1 Float Delay 
H LE, LOCK Valid Delay 
HE, BLE, LOCK Float Delay 
AO, D/C, W/R, ADS Valid Delay 


/R, MAO, D/C, ADS Float Delay | | | 51 | 
| D15—D0 Write Data Valid Delay C. = 50 pF (Note 4) Pag" 7 
2a_| D15-D0 Write Data Hold Time |C.=50pF | 49 


13. | D15—D0 Write Data Float Delay 

14 | HLDA Valid Delay 

14f | HLDA Float Delay 

15 _| NA Setup Time 

16 NA Hold Time 

9 READY Setup Time — 

READY Hold Time 

D15-D0 Read Data Setup Time 
2 D15—D0 Read Data Hold Time 

23 HOLD Setup Time 

24 HOLD Hold Time 


25 | RESET Setup Time 


26__| RESET Hold Time aes (oe 
27 _| NMI, INTR Setup Time (Note 2)| 46 | 


28 | NMI, INTR Hold Time (Note 2)| 46 | 


29 | PEREQ, ERROR, BUSY, FLT*SetupTime{ ==—s—~—=és (Note 2) | 468s 


30 PEREQ, ERROR, BUSY, FLT” Hold Time | | 46 


N 


pare — REO EN |= 
(o>) 


wo 


7 Z| > 
mi) im 
| 
mtelaltefele | fells 
3 


= 
Ol 
oO} W 
w 


11 
2 


NO 
co) 


| 250 | 
Lees 
Ne asl 
| 20 | 
= 
220. 
Pater I 
a 
_ ae 
| 17 | 
| 17 | 


a 
ome, 


—h 


a 
—s 


NO TN 
+ 1 O 


- 





Notes: *Float feature is available in Rev. BO and later. 


omh 


. Float condition occurs when maximum output current becomes less than Ito in magnitude. Float delay is not 100% tested. 


2. These inputs are allowed to be asynchronous to CLK2. The setup and hold specifications are given for testing purposes to 
assure recognition within a specific CLK2 period. 


3. Rise and Fall times are not tested. They are guaranteed by design characterization. 
4. Min time is not 100% tested. 
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SWITCHING CHARACTERISTICS over COMMERCIAL operating ranges 
Switching Characteristics at 33 MHZ: Vcc = 5 V+10%; Tease = 0°C to 100°C 


Operating Frequency: Am386SX CPU Half CLK2 freq. 
Am386SXL CPU Half CLK2 freq. 
CLK2 Period: Am386SX CPU 
Am386SXL CPU 


Parameter Description 






1 





2a CLK2 High Time at2V 


LK2 High Time at 3.7 V 


© 


O 


a 
b 


LK2 Low Time 


CLK2 Low Time 

CLK2 Fall Time 

CLK2 Rise Time 

A23-A1 Valid Delay 

A23-A1 Float Delay 

HE, BLE, LOCK Valid Dela 
. = 50p 


ql 
TT 
: 


@ 
m 
w 


HE, BLE, LOCK Float Delay 
(IO, DIG, W/R, ADS Valid Dela 
11 _ | W/R, M/O, D/G, ADS Float Dela 5 
12 D15—D0 Write Data Valid Delay 


= 
DIO 
O 


Cy 
2a | D15—DO Write Data Hold Time C. = 50 pF 
13 D15—D0 Write Data Float Delay (Note 1) 


—_ 


— 
& N ota lo lo |r < 
ro) o 3 
o 
°o 


14 | HLDA Valid Delay | 

4f | HLDA Float Delay Re ea oe 
15 [NA Setup Time a 
16 | NAHold Time Po 
79 | READY Setup Time . 
| 20 READY Hold Time 


21 | D15~-DO Read Data Setup Time [eee sk tal 






—h 





22 D15—D0 Read Data Hold Time 
23 HOLD Setup Time 


24 | HOLD Hold Time a 
25 | RESET Setup Time ee 


ESET Hold Time 


MI, INTR Setup Time 


) 
MI, INTR Hold Time (Note 2) 5 
) 


PEREQ, ERROR, BUSY Setup Time 
PEREQ, ERROR, BUSY Hold Time (Note 2)| 46 | 


Notes: 1. Float condition occurs when maximum output current becomes less than Ito in magnitude. Float delay is not 100% tested. 


2. These inputs are allowed to be asynchronous to CLK2. The setup and hold specifications are given for testing purposes to 
assure recognition within a specific CLK2 period. 


3. Rise and Fall times are not tested. They are guaranteed by design characterization. 
4. Min time is not 100% tested. 


26 
27 
8 


Ziv 


NO 


, 








co 











® 


0 
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SWITCHING CHARACTERISTICS over COMMERCIAL operating ranges 
Switching Characteristics at 25 MHZ: Vcc = 5 V+10%; Tease = 0°C to 100°C 


Parameter Description 


Operating Frequency: Am386SX CPU Half CLK2 freq. 
Am386SXL CPU Half CLK2 freq. 


CLK2 Period: Am386SX CPU 
Am386SXL CPU 


2a CLK2 High Time at2V 

2b CLK2 High Time at (Vec—0.8 V) 

3a | CLK2 Low Time | at2V 

3b CLK2 Low Time | at0.8V 

4 | CLK2 Fall Time | (Vco—0.8 V) to 0.8 V (Note 3 

5 CLK2 Rise Time 0.8 V to (Vec—0.8 V) (Note 3 
A23-—A1 Valid Delay C. = 50 pF 

23-—A1 Float Delay 

H E, LOCK Valid Dela C. = 50 pF 

LE, LOCK Float Delay (Note 1) 

C. = 50 pF 


1 


as 
G 


phpPHh yA > s > fs 


2 
3 
oy 
2 


a 
ise) 


i 
[s) 


r 
— 


“SJ 
~] 


PEPE? 
=|= Z| 

lO] | m 

ws) es] 


Note 1 


Ww 
oO 


—h — 


NO 
NO 


ee) 
m 
ee) 
i 


, 


: 
Oo 


10, D/C, W/R, ADS Valid Dela 
/R, M/1O, D/C, ADS Float Dela 


15-D0 Write Data Valid Delay 


11 Note 1 


— 
[se] 
© 


O 


= 50 pF 


12 
12a D15—D0 Write Data Hold Time C. = 50 pF 
D15—D0 Write Data Float Delay 


13 
14 LDA Valid Delay 


14f HLDA Float Delay | 


NA Setup Time 

Hold Time - 

Setup Time 

READY Hold Time __ 

5-DO Read Data Setup Time 

D15—D0 Read Data Hold Time 

HOLD Setup Time 

24 


25 RESET Setup Time 


.@) 


= 50 pF 


i 
~] 
N 
NO 


Oo 
nN 
ae) 


is 
Oo 


pms 7 —a | 
OPO! a 


pele ae) 
i 
oO 


r rc 
N 
N 
ow 


O1 
NO 


26 | RESET Hold Time 
| NMI, INTR Setup Time (Note 2)]| 46 


8 | NMI, INTR Hold Time (Note 2)| 46 


29 | PEREQ, ERROR, BUSY, FLT Setup Time (Note 2) 


PEREQ, ERROR, BUSY, FLT Hold Time (Note 2)] 46 


Notes: 1. Float condition occurs when maximum output current becomes less than Ito in magnitude. Float delay is not 100% tested. 


2. These inputs are allowed to be asynchronous to CLK2. The setup and hold specifications are given for testing purposes, to 
assure recognition within a specific CLK2 period. 


3. These are not tested. They are guaranteed by design characterization. 


O1 
NO 





208 Am386 Microprocessors for Personal Computers 


AMD al 


SWITCHING CHARACTERISTICS over COMMERCIAL operating ranges 
Switching Characteristics at 20 MHZ: Vec = 5 V+10%; Tease = 0°C to 100°C 


Ref. 
Operating Frequency: Am386SX CPU Half CLK2 freq. MHz 
Am386SXL CPU Half CLK2 freq. 








20 
20 MHz 
CLK2 Period: Am386SX CPU 
Am386SXL CPU 


CLK2 High Time at2V 


|CLK2HighTime fat (Veon0.8V) 8 
|ClK2LowTime fats 
|CLK2FallTime | (Veo0.8'V) t0.0.8'V (Note 3) | 43 | 
|CLK2RiseTime | 0.8 Vt0 (Veo=0.8.V) (Note 3) | 43 


A23-A1 Valid Delay C. = 120 pF Note 4)} 47 | 


@ 
oO 


NO MP }G]@Ods?M lM] ®] @]a@ 
: COlOI Nolo; as;aol;rMms orm 


— 


=) 
” 


— 


AZ3-Ai Flat Delay 
Note 4) [47 


= 


10b 


Note 4 ae 


— 


3 
BHE, BLE 
BHE, BLE 
G. = 75 pF 
W/R, MAO 
D 


BRE, BLE, COCK Float Delay ec) 
D15-D0Wite Data FloatDelay ——+| SSCS Note t) | ot 


) 
) 
) 
) 
) 
Note 4) Ag 
) 
) 
) 
) 
) 


NO 


LE, LOCK Valid Delay C. = 75 pF 


14f HLDA Float Delay 
NA Hold Time 





9 


READY Setup Time 





15—D0 Write Data Valid Delay | C. = 120p (Note 4)| 47 | 


READY Hold Time Ree es el 
D15-D0 Read Data Setup Time es 






D15—D0O Read Data Hold Time 
HOLD Setup Time 
HOLD Hold Time | 46 | 


4 

4 

4 

5 

4 

5 

4 

5 

4 

5 

5 

4 

4 

4 
RESET Setup Time 5 ns 
RESET Hold Time 
NMI, INTR Setup Time (Note 2)| 46 | 
NMI, INTR Hold Time (Note 2) 
PEREQ, ERROR, BUSY, FLT Setup Time (Note 2)| 46 | 
PEREQ, ERROR, BUSY, FLT Hold Time | 46 | 


Notes: 1. Float condition occurs when maximum output current becomes less than Ito in magnitude. Float delay is not 100% tested. 
2. These inputs are allowed to be asynchronous to CLK2. The setup and hold specifications are given for testing purposes, to 
assure recognition within a specific CLK2 period. 
3. These are not tested. They are guaranteed by design characterization. 


4. Tested with C. set at 50 pF and derated to support the indicated distributed capacitive load. See Figures 53 and 54 for the 
capacitive derating curve. 


1 
2a 
2b 
3a 
3b 
4 
5 
7 
10a 
11 
12 
13 
14 
15 
16 
1 
0 
21 
2 
23 
4 
5 
6 
7 
8 
9 


2 
2 
2 
2 
2 
2 
2 
2 


a 

eee 

Loe 

poe! 

ee ol 

ae 

i 
I 
| WIR, MO, D/C, ADS FloatDelay | (Note t) | 51 | 
Le 

| 
eee 

eee! 

eae. 

ed 

dee 

ce! 

| 16 

E14 








43 
43 
43 
43 
43 

3 
43 
3 
7 
1 
7 
1 
47 
7 
1 
7 
6 
46 
6 
46 
46 
6 
46 
46 
2 
2 
46 
6 
46 
46 
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SWITCHING CHARACTERISTICS over COMMERCIAL operating ranges 
Switching Characteristics at 16 MH2Z*: Vcc = 5 V+10%; Tease = 0°C to 100°C 


Operating Frequency: Am386SX CPU Half CLK2 freq. 

| Am386SXL CPU Half CLK2 freq. 
1 CLK2 Period: Am386SX CPU 

Am386SXL CPU 

2a__| CLK2 High Time 
2b CLK2 High Time at (Vcc—0.8 V) 
3a___| CLK2 Low Time 
3b__| CLK2 Low Time 

L 


CLK2 Fall Time (Vcc—0.8 V) to 0.8 V (Note 3 
K2 Rise Time 0.8 V to (Vec—0.8 V) (Note 3 


) 

C ) 
A23-A1 Valid Delay Ci. = 120 pF (Note 4) 

7 A ) 
) 


23-Al Float Delay 


HE, BLE, LOCK Valid Delay C. = 75 pF (Note 4 
, BLE, LOCK Float Delay (Note 1 
/R, MAO, D/C, ADS Valid Delay C. = 75 pF (Note 4 


) 
) 
/R, MAO, D/C, ADS Float Delay (Note 1) 
) 
) 


i 
in 
a 


| 


w 
aa 
m 


|| Dl 


14 


O 


15—D0 Write Data Valid Delay Ci. = 120 pF (Note 4 
D15-D0 Write Data Float Delay 
HLDA Valid Delay C. = 75 pF (Note 4) 
[NASetupTime | 
NA Hold Time a 


12 
13 


a 
= 
Oo 
> 
a 
re) 

2 
O 
oO 
2 
< 


[RERDVHoldTime —SOS—~—~S 
[D15-DO Read DataSeupTine «|S 
HOLD SetupTime SSCs 
[HOLD HoldTime ——SSSSCS—~iS 
[RESET SeupTime——SOSSC—C—~SSSSSS 
[RESET HoldTime ——SSOSC—~sSCOSSSSCSCSC~S~S~S 


Notes: *Contact AMD for 16-MHz availability. 
1. Float condition occurs when maximum output current becomes less than Ito in magnitude. Float delay is not 100% tested. 


2. These inputs are allowed to be asynchronous to CLK2. The setup and hold specifications are given for testing purposes, to 
assure recognition within a specific CLK2 period. 


3. These are not tested. They are guaranteed by design characterization. 


4. Tested with Cx set at 50 pF and derated to support the indicated distributed capacitive load. See Figures 53 and 54 for the 
capacitive derating curve. 


2a) 
| 2b 
| 3a 
| Sb 
aa 
Ee 
feo 
aa 
ae 
[Oe 
Ea 
ee al 
13 
cr 
| at 
ie 
Cae! 
eo 
| 20 
| 21 
| 22 
| 23 | 
| 24 
| 25 
| 26 
Ea 
| 28 


2 
2 
2 
2 
2 
2 
2 
2 
2 


14 
14f 
15 
16 
19 
0 
1 
2 
3 
4 
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Figure 43. CLK2 Timing (16, 20, 25, and 33 MHz) 


CLK2 





15022B-031a 


Figure 44. CLK2 Timing (40 MHz) 


Am386SXL CPU Output 


Cr 


15022B-032 


Figure 45. AC Test Circuit 
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SWITCHING WAVEFORMS 


CLK2 





HOLD 


D15—Do 
(Inputs) 


BUSY, ERROR 
PEREQ, FLT 


INTR, NMI 


CLK2 


A23-A1 
Di5—Do 


(Outputs) 


HLDA 


212 


m1) #FOIT POT OTTO TT TOT 


mT I l I l I l I l I l 


02 o1 Tx 2 01 Tx 









15022B-033 

Figure 46. Input Setup and Hold Timing 
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Figure 47. Output Valid Delay Timing 
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SWITCHING WAVEFORMS (continued) 
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Figure 48. Write Data Valid Delay Timing (20 and 25 MHz) 
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Figure 49. Write Data Hold Timing 
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Figure 50. Write Data Valid Delay Timing (20 MHz) 
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A23-A1 


D15—D0o 


HLDA 


214 


1 


TiorT1 


o 
NM 


ma 
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t13—Also applies to data float when write 
It 4f cycle is followed by read or idle. 
| | | [t14 | 


oe ae a 












15022B—035 
Figure 51. Output Float Delay and HLDA Valid Delay Timing 
RESET Initialization Sequence 
o2 or o1 02 o 1 
15022B-036 


Figure 52. RESET Setup and Hold Timing and Internal Phase 
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nom —6 
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Figure 53. Typical Output Valid Delay Versus 
Load Capacitance at Maximum Operating 
Temperature (C, = 120 pF) 
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Figure 55. Typical Output Valid Delay Versus 
Load Capacitance at Maximum Operating 
Temperature (C.=50 pF) 
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nom + 9 


nom + 6 
nom+3 
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nom —3 





nom -6 | 
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Figure 54. Typical Output Valid Delay Versus 
Load Capacitance at Maximum Operating 


Rise Time (ns) 
0.8 V-2.0 V 


Temperature (C. = 75 pF) 





50 75 100 125 150 
Ci (picofarads) 


Figure 56. Typical Output Rise Time Versus Load 
Capacitance at Maximum Operating Temperature 





DIFFERENCES BETWEEN THE Am386SX/ 
SXL CPU AND THE Am386DX/DXL CPU 


The following are the major differences between the 
Am386SX/SXL CPU and the Am386DX/DXL CPU: . 


1. The Am386SX/SXL CPU generates byte selects on 
BHE and BLE (like the 8086 and 80286) to 
distinguish the upper and lower bytes on its 16-bit 
data bus. The Am386DX/DXL CPU uses four byte 


selects, BE3-BE0, to distinguish between the 
different bytes on its 32-bit bus. 


. The Am386SX/SXL CPU has no bus sizing option. 


The Am386DX/DXL CPU can select between either 
a 32-bit bus or a 16-bit bus by use of the BS16 input. 
The Am386SX/SXL CPU has a 16-bit bus size. 





3. The NA pin operation in the Am386SX/SXL CPU is 


identical to that of the NA pin on the Am386DX/DXL 
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CPU with one exception: the Am386DX/DXL CPU 


NA pin cannot be activated on 16-bit bus cycles 
(where BS16 is Low in the Am3886DX/DXL CPU 
case), whereas NA can be activated on any 
Am386SX/SXL CPU bus cycle. 


4. The contents of all AmM386SX/SXL CPU registers at 
reset are identical to the contents of the Am3886DX/ 
DXL CPU registers at reset, except the DX register. 
The DX register contains a component-stepping 
identifier at reset, that is, 
in AmM3886DX/DXL CPU, after reset 


DH =3 indicates Am386DX/DXL CPU 
DI = revision number; 


in Am386SX/SXL CPU, after reset 


DH = 23H indicates AmM386SX/SXL CPU 
DL = revision number. 


5. The Am3886DX/DXL CPU uses A31 and M/IO as 
selects for the math coprocessor. The Am386SX/ 
SXL CPU uses A23 and M/IO as selects. 


6. The Am386DX/DXL CPU prefetch unit fetches code 
in four-byte units. The Am386SX/SXL CPU prefetch 
unit reads two bytes as one unit (like the 80286). In 
BS16 mode, the Am386DX/DXL CPU takes two 
consecutive bus cycles to complete a prefetch 
request. If there is a data read or write request after 
the prefetch starts, the Am386DX/DXL CPU will 
fetch all four bytes before addressing the new 
request. 


7. Both Am3886DX/DXL CPU and Am386SX/SXL CPU 
have the same logical address space. The only 
difference is that the Am386DX/DXL CPU has a 
32-bit physical address space and the Am386SX/ 
SXL CPU has a 24-bit physical address space. The 
Am386SX/SXL CPU has a physical memory 
address space of up to 16 Mb instead of the 4 Gb 
available to the Am3886DX/DXL CPU. Therefore, in 
Am386SX/SXL CPU systems, the operating system 
must be aware of this physical memory limit and 
should allocate memory for applications programs 
within this limit. If an Am3886DX/DXL CPU system 
uses only the lower 16 Mb of physical address, then 
there will be no extra effort required to migrate 
Am386DX/DXL CPU software to the Am386SX/SXL 
CPU. Any application which uses more than 16 Mb of 
memory can run on the Am3886SX/SXL CPU, if the 
operating system utilizes the Am386SX/SXL CPU’s 
paging mechanism. In spite of this difference in 
physical address space, the Am386SX/SXL CPU 
and Am386DX/DXL CPU can run the same 
operating systems and applications within their 
respective physical memory constraints. 

8. The Am386SX/SXL CPU has an input called FLT 
which three-states all bi-directional and output pins, 
including HLDA, when asserted. It is used with ON- 
Circuit Emulation (ONCE). 


INSTRUCTION SET 


This section describes the instruction set. The Instruc- 
tion Set Clock Count Summary lists all instructions 





along with instruction encoding diagrams and clock 
counts. Further details of the instruction encoding are 
then provided in the following sections, which 
completely describe the encoding structure and the 
definition of all fields occurring within instructions. 


The Am386SX/SXL CPU _ instruction 
Encoding and Clock Count Summary 


To calculate elapsed time for an instruction, multiply the 
instruction clock count, as listed in the Instruction Set 
Clock Count Summary, by the processor clock period 
(e.g., 40 ns for a 25-MHz, 50 ns for a 20-MHz, and 
62.5 ns for a 16-MHz Am386SX/SXL microprocessor). 
The actual clock count of an Am386SX/SXL CPU 
program will average 5% more than the calculated clock 
count due to instruction sequences which execute faster 
than they can be fetched from memory. 


Instruction Clock Count Assumptions 


1. The instruction has been prefetched, decoded, and 
is ready for execution. 


2. Bus cycles do not require wait states. 


3. There are no local bus HOLD requests delaying 
processor access to the bus. 


4. No exceptions are detected during instruction 
execution. 


5 If an effective address is calculated, it does not use 


two general register components. One register, 
scaling and displacement can be used within the 
clock counts shown. However, if the effective 
address calculation uses two general register 
components, add 1 clock to the clock count shown. 


Instruction Clock Count Notation 


1. If two clock counts are given, the smaller refers to a 
register operand and the larger refers to a memory 
operand. 

2. n=number of times repeated. 

3. m= number of components in the next instruction 
executed, where the entire displacement (if any) 
counts as one component, the entire immediate data 
(if any) counts as one component, and all other bytes 
of the instruction and prefix(es) each count as one 
component. 

Misaligned or 32-Bit Operand Accesses 


—— lf instructions access a misaligned 16-bit operand or 
32-bit operand on even address add: 


2x Clocks for read or write 
4x clocks for read and write 


—Jlf instructions access a 32-bit operand on odd 
address add: 


4x clocks for read or write 
8 x clocks for read and write 
Wait States 


Wait states add 1 clock per wait state to instruction 
execution for each data access. 
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Am386SX/SXL Instruction Set Clock Count Summary 


instruction 
GENERAL DATA TRANSFER 
MOV =Move: 


Register to Register/Memory 
Register/Memory to Register 
Immediate to Register/Memory 
Immediate to Register (short form) 
Memory to Accumulator (short form) 
Accumulator to Memory (short form) 


Register/Memory to Segment Register 


| Segment Register to Register/Memory 


| MOVSX = Move with Sign Extension 
Register from Register/Memory 
MOV2ZX = Move with Zero Extension 
Register from Register/Memory 
PUSH = Push: 
Register/Memory 


Register (short form) 


| Segment Register (ES,CS,SS, or DS) (short form) 


| Segment Register (ES, CS, SS, DS, FS, or GS) 


| immediate 
PUSHA = Push All 
POP =Pop 
Register/Memory 
Register (short form) 


Segment Register (ES, CS, SS, or DS) 


Segment Register (ES, CS, SS, DS, FS, or GS) 


POPA=Pop All 
XCHG = Exchange 
Register/Memory with Register 
Register with Accumulator (short form) 
IN = Input From: 

| Fixed Port 


| Variable Port 


AMD al 


Clock Count__[ Notes] 


| 8086 Mode 


1000100w{]mod-+reg r/m 
1000101wI{modreg r/m 


11000%1%1wtImod000_ frm| immediate data 


1011Ww_ reg | immediate data 


1010000 w | full displacement 


101000 1 w | full displacement 


10001110 ]modsreg3 t/m|] 


10001100 | mod sreg r/m 


00001111 


0000111171011 0411WI modreg rm | 


11111144 %4]mod110 rm 


01010 reg 


000 sreg 2 110] 


00001111 


10 sreg3 000 | 


0110%10s 0 | immediate data 


01100000 


100011114 ]mod000 tim 


01011 reg 


000 sreg 2 111 


00001114141 410 sreg3 001 


01100001 


1000011 wy] modreg r/m | 


10010 reg 


CLK Count 
Virtual 8086 Mode 


111 00t0w| portnumber | 


1110110wyt 


Real Real 
Address Address Protected 
Mode/ Mode/ Virtual 
Virtual Virtual Address 
8086 Mode Mode 


6*/26* 


7*/27* 





*IfCPL<IOPL **If CPL>IOPL  ‘***Clock count shown applies if I/O permission allows I/O to the port in Virtual 8086 Mode. If 1/O bit map 
denies permission Exception 13 fault occurs; refer to clock counts for INT3 instruction. 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 





Instruction 

CUTS CuIPUETe: Vidic pees Hoe 

Fixed Port 24*** 4*/24* 

Variable Port eon? 5*/25* 

LEA = Load EA to Register 2 

SEGMENT CONTROL 

LDS =Load Pointer to DS 26*/28* 

LES =Load Pointer to ES 26"/28" 
| LFS =Load Pointer to FS f00001111[10110100| modreg rim] | 26*/28* 
| .as=Load Pointer GS ee 
| LSS = Load Pointer to SS Jo0001111{10110010| modreg rim] | | 26*/28* 

FLAG CONTROL 

CLC =Clear Carry Flag 

CLD = Clear Direction Flag 
| CLI = Clear Interrupt Enable Flag 

CLTS=Clear Task Switched Flag 100001111 {00000110 

CMC = Complement Carry Flag 

LAHF = Load AH into Flag 

POPF = Pop Flags 

PUSHF = Push Flags 

SAHF = Store AH into Flags 

STC =Set Carry Flag 

STD = Set Direction Flag 

STI =Set Interrupt Enable Flag 

ARITHMETIC 

ADD= Add 

Register to Register 

Register Memory 

Memory to Register 

Immediate to Register/Memory immediate data 

Immediate to Accumulator (short form) immediate data 

ADC = Add with Carry 
| Register to Register l000100dw|modreg —_r/m| 





*If CPL<IOPL **IfCPL>IlOPL ***Clock count shown applies if !/O permission allows I/O to the port in Virtual 8086 Mode. If I/O bit map 
denies permission Exception 13 fault occurs; refer to clock counts for INT3 instruction. 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 


instruction 

| ADC =Add with Carry (continued) 
Register to Memory 
Memory to Register 
Immediate to Register/Memory 
Immediate to Accumulator (short form) 
INC =Increment 
Register/Memory 
Register (short form) 

| SUB = Subtract 

| Register from Register 
Register from Memory 
Memory from Register 
Immediate from Register/Memory 
Immediate from Accumulator (short form) 
SBB=Subtract with Borrow 
Register from Register 
Register from Memory 
Memory from Register 
Immediate from Register/Memory 
Immediate from Accumulator (short form) 
DEC=Decrement 
Register/Memory 
Register (short form) 
CMP = Compare 
Register with Register 
Memory with Register 
Register with Memory 
Immediate with Register/Memory 
Immediate with Accumulator (short form) 
NEG= Change Sign 


AAA= ASCIi Adjust for Add 


“IfCPLsIOPL ** If CPL>IOPL 


0001000W 


0001001w 


100000S Ww 


0001010w 


11111114Ww 


01000 reg 


001010dw 


0010100w| 


0010101w 


100000sw 


0010110w 


000110dw 


0001100w 


0001101w 


100000sw 


0001110w| 


1111111Ww 


01001 reg 


001110dw 


0011100Ww 


0011101Ww 


100000sw 


0011110Ww 


gia eet Oi eas 


00110111 


mod reg r/m 
mod reg r/m 
mod 010 fm 


immediate data 


mod 000 tm] 


mod reg r/m f 


mod reg r/m | 


mod reg r/m 
mod 101 t/m 


immediate data 


mod reg rm 
mod reg r/m 
mod reg r/m 
mod 011 f/m 


immediate data 


reg 001 f/m 


mod reg r/m | 


mod reg r/m 


mod reg r/m 


mod 111 r/m | 


immediate data 


mod 011 tm 





ClockCount_ [| Notes 


Real Real 
Address | Address 


Mode/ | Mode/ 
| Virtual ; | Virtual 
8086 Mode 


8086 Mode 


immediate data 


immediate data 


immediate data 


immediate data 





Am386SX/SXL Microprocessor Data Sheet 219 














al AMD 
Am386SX/SXL Instruction Set Clock Count Summary (continued) 





Instruction Format 
| AAS = ASCIl Adjust for Subtract 001111141 
DAA = Decimal Adjust for Add 00100111 


DAS = Decimal Adjust for Subtract 00101111 


MUL = Multiply (unsigned) 


mod 100 f/m 


Accumulator with Register Memory 1111011w 
Multiplier ~ Byte 12-17/15-20* | 2-17/15-20* 
— Word 12-25/15-28* | 2-25/15~—28* 
—Doubleword 12-41/17—-46* }2-41/17—46* 
IMUL = Integer Multiply (signed) 


Accumulator with Register Memory 1111011Wy]mod101 rmyq 


| Multiplier — Byte 
~ Word 
— Doubleword 


12—17/15-20* 
12-25/15-28* 
12-41/1 7-46" 


2-17/15-20" | 
2-25/15-28" | 


2-41/17—-46* | 


Register with Register/Memory 00001111/1010111411] modreg rm 


Multiplier — Byte 12—17/15-20* }2-17/15—-20* 


Nake - 2-25/15-28" 
~Doublewor 2-41/17-46" 


Register/Memory with Immediate to Register 01101081 | modreg r/ 


immediate data 


—Word 
—Doubleword 


DIV = Divide (unsigned) 


Accumulator by Register/Memory 11110141Wwi]mod110 tm 


Divisor — Byte 
— Word 
— Doubleword 


IDIV = Integer Divide (signed) 


Accumulator by Register/Memory 111101%11Wwtlmod1%411 = m 
Divisor ~— Byte 

~ Word 

— Doubleword 


AAD=ASCIl Adjust for Divide 11010101/00001010 


AAM=ASCIl Adjust for Multiply 11010100/00001010 


CBW =Convert Byte to Word 10011000 


CWD =Convert Word to Double Word 10011001 
LOGIC 
Shift/Rotate Instruction 


Not Through Carry (ROL, ROR, SAL, SAR, SHL, and SHR) 





Register/Memory by 4 1101000WwW|mod TTT tm 


*ifCPL<IOPL ** If CPL>IOPL 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 


| Instruction 


LOGIC (continued) 


Format 


Not Through Carry (ROL, ROR, SAL, SAR, SHL, and SHR) —(continued) 


Register/Memory by CL 
Register/Memory by Immediate Count 
Through Carry (RCL and RCR) 
Register/Memory by 1 
Register/Memory by CL 


Register/Memory by Immediate Count 


SHLD = Shift Left Double 
Register/Memory by immediate 
Register/Memory by CL 
SHRD = Shift Right Double 
Register/Memory by Immediate 
Register/Memory by CL 
AND=And 
Register to Register 
Register to Memory 
Memory to Register 
Immediate to Register/Memory 
Immediate to Accumulator (short form) 
TEST = And Function to Flags, No Result 
| Register/Memory and Register 
Immediate Data and Register/Memory 
| Immediate Data and Accumulator (short form) 
OR=Or 
Register to Register 
Register to Memory 


Memory to Register 


*IfCPL<IOPL **IfCPL>IOPL (1) Immediate 8-Bit Data 





1101001Ww 


1100000w 


mod TTT r/m 


mod TTT r/m 1} (1) 


1101000w 


1101001Ww 


1100000w 


TIT 
000 
001 
010 
011 
100 
101 
111 


00001111 


00001111 


00001111 


00001111 


001000dw 


0010000Ww 


= 


mod TTT r/m 
mod TTT r/m 


mod TTT r/m | (1) 


Instruction 
ROL 
ROR 
RCL 
RCR 

SHL/SAL 
SHR 
SAR 


110100101] modreg 


mod reg / 


mod reg r/m 


| 


0010001w 


1000000Ww 


0010010WwW 


1000010W 


1111011w 


1010100WwW 


000010dw 


mod reg r/ 


r/m 


101011011] modreg 


r/m 


mod 100 fr/m] immediate data 


immediate data 


mod reg | r/m 


immediate data 


mod reg rim 


0000100w{]{modreg r/m 


000010iw 


mod reg r/m 





mod 000 ft/m{ immediate data 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 


Protected 
Virtual 
: Address 
Instruction Mode 
LOGIC (continued) 
Immediate to Register/Memory 1000000wt|{mod 001 = t/m|{ immediate data 
Immediate to Accumulator (short form) 000011 0 wj] immediate data 


XOR =Exclusive Or 


Register to Register 1001100dwtImodreg r/ 


3 


| Register to Memory 001%1000w|]|modreg r/ 


3 


| Memory to Register t 011001 w{]|mod reg r/m 


m | immediate data 


Immediate to Register/Memory 1000000wfmod110 1 


Immediate to Accumulator (short form) 0011010 wf] immediate data 


NOT =Invert Register/Memory 
STRING MANIPULATION 
Clock Count 

| CMPS = Compare Byte/Word a eg 10° h 
INS = Input Byte/Word from DX Port } zane 9*/29"* s/t, h,m 
LODS = Load Byte/Word to AV/AX/EAX oe h 
MOVE = Move Byte/Word 7* h 
OUTS = Output Byte/Word to DX Port Tee | | s/t,h,m 
SCAS = Scan Byte/Word 
STOS = Store Byte/Word from ALIAX/EX 
XLAT = Translate String 
REPEATED STRING MANIPULATION 
Repeated by Count in CX or ECX 
REPE CMPS =Compare String (Find non-match) h 


REPNE CMPS =Compare String (Find match) 11110010/1010011wyi h 


REP INS = Input String 111110010]/0110110w | oe | s/t, h,m 


REP LODS=Load String 111110010 


1010110Ww 


REP MOVS = Move String 11110010/1010010w 


REP OUTS = Output String 1111001070110111w 
REPE SCAS=Scan String (Find non-AL/AX/EAX) }11110011]10101141w 


REPNE SCAS = Scan String (Find AL/AX/EAX) 11110010/1010111w 


| REP STOS=Store String 11111001041010101Ww 





*If CPL<SIOPL ** If CPL>IOPL ***Clock count shown applies if I/O permission allows i/O to the port in Virtual 8086 Mode. If I/O bit map 
denies permission Exception 13 fault occurs; refer to clock counts for INT3 instruction. 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 





Instruction Format 
BIT MANIPULATION 


BSF =Scan Bit Forward 00001111 mod reg r/m | (1) 
BSR =Scan Bit Reverse 00001111 mod reg r/m 
BT =Test Bit 
Register/Memory, Immediate 00001111 mod 100 f/m | (1) 
Register/Memory, Register 00001111 101000114] mod reg r/m 
BTC = Test Bit and Complement 
Register/Memory, Immediate 00001111 mod 111 f/m | (1) 
Register/Memory, Register 00001111 mod reg rm 


BTR = Test Bit and Reset 


Register/Memory, Immediate 00001111]/1011%1010/] mod 110 rm j (1) 


Register/Memory, Register 00001111{/101100114 modreg r/m 


BTS = Test Bit and Set 


Register/Memory, Immediate 00001111/10111010/]mod101 rm] (1) | | | 
| Register/Memory, Register 00001111410101011{ modreg rm | 


| CONTROL TRANSFER 
CALL =Call | 
Direct Within Segment 11101000 | full displacement 


Register/Memory 
Indirect Within Segment 111111141 4mod010 tm 


Direct Intersegment 10041101 0 | Unsigned full offset, selector 


Protected Mode Only (Direct Intersegment) 

Via Call Gate to Same Privilege Level 64+m 
Via Call Gate to Different Privilege Level (No Parameters) 98 +m 
Via Call Gate to Different Privilege Level (x Parameters) 106 + 8x+m 
From 80286 Task to 80286 TSS 285 
From 80286 Task to Am386SX/SXL CPU TSS 310 
From 80286 Task to Virtual 8086 Task (Am386SX/SXL CPU TSS) 229 
From Am386SX/SXL CPU Task to 80286 TSS 285 
From Am386SX/SXL CPU Task to Am386SX/SXL CPU TSS 392 
From Am386SX/SXL CPU Task to Virtual 8086 Task (Am386SX/SXL CPU TSS) 309 


Indirect Intersegment 46+m 
111111441 [mod 011 tm 
Protected Mode Only (Indirect Intersegment) 


Via Call Gate to Same Privilege Level 68 +m 
Via Call Gate to Different Privilege Level (No Parameters) 102+m 
Via Call Gate to Different Privilege Level (x Parameters) 110+8x+m 
From 80286 Task to 80286 TSS 

From 80286 Task to Am386SX/SXL CPU TSS . 
From 80286 Task to Virtual 8086 Task (Am386SX/SXL CPU TSS) | ; 
From Am386SX/SXL CPU Task to 80286 TSS 
From Am386SX/SXL CPU Task to Am386SX/SXL CPU TSS 

From Am386SX/SXL CPU Task to Virtual 8086 Task (Am386SX/SXL CPU TSS) 


*IfCPL<IOPL ** If CPL>IOPL (1) Immediate 8-bit data 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 

| [— ciesk Count [Notes] 
earess | Protected pee, Protected | 
Mode/ Virtual Mode/ Virtual 


. Virtual Address Virtual Address 
Instruction Format 8086 Mode Mode 8086 Mode Mode 








CONTROL TRANSFER (continued) 


JMP = Unconditional Jump 


Short 1110101 1 } 8-bit displacement 


Direct within Segment 11010001 | full displacement 


Indirect Within Segment 1441111414 4mod 100 tm 


Direct Intersegment 1110101 0 | unsigned full offset, selector 


Protected Mode Only (Direct Intersegment) 
Via Call Gate to Same Privilege Level 
From 80286 Task to 80286 TSS 
From 80286 Task to Am386SX/SXL CPU TSS 
From 80286 Task to Virtual 8086 Task (Am386SX/SXL CPU TSS) 
From Am3886SX/SXL CPU Task to 80286 TSS 
From Am386SX/SXL CPU Task to Am386SX/SXL CPU TSS 
From Am386SX/SXL CPU Task to Virtual 8086 Task (Am386SX/SXL CPU TSS) 


| Indirect Intersegment 14111114 )mod 101 rm] 


Protected Mode Only (Indirect Intersegment) 
Via Call Gate to Same Privilege Level 
From 80286 Task to 80286 TSS 
From 80286 Task to Am386SX/SXL CPU TSS 
From 80286 Task to Virtual 8086 Task (Am386SX/SXL CPU TSS) 
From Am386SX/SXL CPU Task to 80286 TSS 
From Am386SX/SXL CPU Task to Am386SX/SXL CPU TSS 
From Am386SX/SXL CPU Task to Virtual 8086 Task (Am386SX/SXL CPU TSS) 


RET = Return from Call 


Within Segment 
11000011 


Within Segment Adding Immediate to SP 
1100001 0 | 16-bit displacement 


Intersegment 
11001011 


Intersegment Adding Immediate to SP 
1100101 0 | 16-bit displacement 


Protected Mode Only (RET): to Different Privilege Level 
Intersegment 
Intersegment Adding Immediate to SP 


CONDITIONAL JUMPS (Note: Times are Jump “Taken or Not Taken”) 
JO = Jump on Overflow 


7+mor3]7+mor3 
8-bit Displacement 


ass laa 
Full Displacement 01110000 | 8-bit displacement 
JNO = Jump on Not Overflow 00001111410000000 full displacement 
8-bit Displacement 
Full Displacement 101110001 | 8-bitdisplacement | 
loooo1 111710000001 {| full displacement 





*IfCPL<!OPL = ** if CPL>IOPL 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 





Instruction 


CONDITIONAL JUMPS (continued) 


Format 


JB/JNAE = Jump on Below/Not Above or Equal 


8-bit Displacement 


Full Displacement 


0111001 0 | 8-bit displacement 


00001111/10000010 full displacement 


JNB/JAE = Jump on Not Below/Above or Equal 


8-bit Displacement 

Full Displacement 

JE/JZ = Jump on Equal/Zero 

8-bit Displacement 

Full Displacement 

JNE/JNZ = Jump on Not Equal/Not Zero 
8-bit Displacement 


Full Displacement 


01110011 


8-bit displacement 


00001111110000011 full displacement 


01110100 | 8-bit displacement 


00001111410000100 full displacement 


011104101 | 8-bit displacement 


000011114,10000101 full displacement 


| JBE/JNA = Jump on Below or Equal/Not Above 


| 8-bit Displacement 


Full Displacement 


01110110 { 8-bit displacement 


00001111710000110 full displacement 


JNBE/JA =Jump on Not Below or Equal/Above 


8-bit Displacement 

Full Displacement 

JS = Jump on Sign 

8-bit Displacement 

Full Displacement 

JNS = Jump on Not Sign 

8-bit Displacement 

Full Displacement 

JP/JPE = Jump on Parity/Parity Even 
8-bit Displacement 

Full Displacement 

JNP/JPO = Jump on Not Parity/Parity Odd 
8-bit Displacement 


Full Displacement 


011104111 | 8-bit displacement 


00001111710000111 full displacement 


01111000 | 8-bit displacement 


00001111;410001000 


full displacement 


01111001 | 8-bit displacement 


00001111/10001001 full displacement 


0111101 0 | 8-bit displacement 


000011114]10001010 full displacement 


01111011 | 8-bitdisplacement | 


00001111 


10001011 | full displacement 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 


Instruction 


CONDITIONAL JUMPS (continued) 


Format 


JL/JNGE = Jump on Less/Not Greater or Equal 


8-bit Displacement 


| Full Displacement 


10114111100 | 8-bitdisplacement | 
100001111{/10001100 | fulldisplacement 





JNL/JGE = Jump on Net Less/Greater or Equal 


8-bit Displacement 


Full Displacement 


011111401 | 8-bit displacement 7+mor3 


000011114)10001101 full displacement 7+mor3 


JLE/JNG=Jump on Less or Equal/Not Greater 


8-bit Displacement 


Full Displacement 


011111410 | 8-bitdisplacement | 7+mor3 


00001111{4100011410 {| full displacement 7+mor3 


JNLE/JG=Jump on Not Less or Equal/Greater 


| 8-bit Displacement 

| Full Displacement 

| JCXZ= Jump on CX Zero* 
JECXZ = Jump on ECX Zero 
LOOP = Loop CX Times 
LOOPZ/LOOPE = Loop with Zero/Equal 


| LOOPNZ/LOOPNE = Loop while Not Zero 


ov 414114 | Bit isplacement | 7T+mors 
loo0011114]10001111 | full displacement 7+mor3 
[11100011 | ebitdispiacement | Q+mors 
[111000114 |abitdisplecement | | 9+mors 
Hem 
11100001 | B-bitdisplacement | 114m 
[11100000 stitaispiacement | Hem 





CONDITIONAL BYTE SET (Note: Times Are Register/Memory) 


SETO= Set Byte on Overflow 
To Register/Memory 
SETNO = Set Byte on Not Overflow 


To Register/Memory 


00001111/10010000]mod000 tm 


00001111{/10010001]mod000 r/m 


SETB/SETNAE = Set Byte on Below/Not Above or Equal 


To Register/Memory 





000011114/10010010f mod 000 t/m 


SETNB = Set Byte on Not Below/Above or Equal 


To Register/Memory 
SETE/SETZ = Set Byte on Equal/Zero 


To Register/Memory 


00001111{{10010011]mod 000 tm 
00001111;110010100] mod 000 rm 


| SETNE/SETNZ = Set Byte on Not Equal/Not Zero 


To Register/Memory 





00001111110010101{mod000 rm | 


* Address Size Prefix differentiates JCXZ from JECXZ 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 
| | _ClockCount_ | Notes 


Real 
Address 
Mode/ 
: Virtual 
Instruction Format 8086 Mode 






CONDITIONAL BYTE SET (continued) 


SETBE/SETNA = Set Byte on Below or Equal/Not Above 


To Register/Memory 00001111710010%1%10]mod000 tm 


SETNBE/SETA = Set Byte on Not Below or Equal/Above 


To Register/Memory 00001111/100101%11{]mod 000 tm 


SETS =Set Byte on Sign 


To Register/Memory 00001111/10011000]mod000 tm | 


| SETNS = Set Byte on Not Sign 


To Register/Memory 00001111{/1001%1001]mod000 tm 


SETP/SETPE = Set Byte on Parity/Parity Even 


To Register/Memory 00001111{100110%10]mod000 t/m 


SETNP/SETPO = Set Byte on Not Parity/Parity Odd 


To Register/Memory 00001111/47/10011011{mod000 rm 


SETL/SETNGE = Set Byte on Less/Not Greater or Equal 


To Register/Memory 000011114/10011100] mod000 tm 


SETNL/SETGE = Set Byte on Not Less/Greater or Equal 


| To Register/Memory 0000111140111%1%101{]mod000 tm 


| SETLE/SETNG = Set Byte on Less or Equal/Not Greater 


| To Register/Memory 00001111/10011110; mod 000 f/m 


SETNLE/SETG =Set Byte on Not Less or Equal/Greater 


To Register/Memory 00001111/10011111{]mod000 t/m 


ENTER =Enter Procedure 11001000 | 16-bit displacement, 8-bit level 
L=0 10 10 
L=1 14 14 
L>1 17+8(n—1) | 17+8(n-1) 


LEAVE = Leave Procedure 


11001001 
INTERRUPT INSTRUCTIONS 


INT = Interrupt: 


Type Specified 
11001101 | type 


Type 3 
11001100 
INTO =Interrupt 4 if Overflow Flag Set 
If OF =1 
lf OF =0 


11001110 


“If CPL<SIOPL = ** If CPL>IOPL 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 





Instruction 

INTERRUPT INSTRUCTIONS (continued) 
INT = Interrupt: 

Type Specified 


Type 3 


Bound = Interrupt 5 if Detected Value Out of Range 


lf Out of Range e,g,h,j,k,r 
If In Range e,g,h,j,k,r 
Protected Mode Only (INT) 


INT: Type Specified 
Via Interrupt or Trap Gate to Same Privilege Level 
Via Interrupt or Trap Gate to Different Privilege Level g, j,k, Fr 
From 80286 Task to 80286 TSS via Task Gate g, j,k, r 
From 80286 Task to Am386SX/SXL CPU TSS via Task Gate | g,j,k,r 
From 80286 Task to Virtual 8086 Mode via Task Gate g,j,k,r 
From Am386SX/SXL CPU Task to 80286 TSS via Task Gate g,j,k,r 
From Am386SX/SXL CPU Task to AM386SX/SXL CPU TSS via Task Gate g, j,k, r 
From Am386SX/SXL CPU Task to Virtual 8086 Mode via Task Gate 9, }, kr 
From Virtual 8086 Mode to 80286 TSS via Task Gate | g, j,k, r 
From Virtual 8086 Mode to Am386SX/SXL CPU TSS via Task Gate g, j,k, r 
From Virtual 8086 Mode to Privilege Level 0 via Trap Gate or Interrupt Gate 9, I ‘ r 
g, J, «,F 
INT: Type 3 
Via Interrupt or Trap Gate to Same Privilege Level 
Via Interrupt or Trap Gate to Different Privilege Level g,j,k,r 
From 80286 Task to 80286 TSS via Task Gate | g.j,k,r 
From 80286 Task to Am386SX/SXL CPU TSS via Task Gate g,j,k,r 
From 80286 Task to Virtual 8086 Mode via Task Gate g, j,k, r 
From Am386SX/SXL CPU Task to 80286 TSS via Task Gate g, j,k, r 
From Am386SX/SXL CPU Task to Am386SX/SXL CPU TSS via Task Gate g,j,k,r 
From Am386SX/SXL CPU Task to Virtual 8086 Mode via Task Gate g, j,k, r 
From Virtual 8086 Mode to 80286 TSS via Task Gate g,j,k,r 
From Virtual 8086 Mode to Am386SX/SXL CPU TSS via Task Gate g,j,k,r 
From Virtual 8086 Mode to Privilege Level 0 via Trap Gate or Interrupt Gate g, h r 
g, J, «,F 
INTO 
Via Interrupt or Trap Gate to Same Privilege Level 
Via Interrupt or Trap Gate to Different Privilege Level . g,j,k,r 
From 80286 Task to 80286 TSS via Task Gate g, j,k, r 
From 80286 Task to Am386SX/SXL CPU TSS via Task Gate g,j,k,r 
From 80286 Task to Virtual 8086 Mode via Task Gate g,j,k,r 
From Am3886SX/SXL CPU Task to 80286 TSS via Task Gate g,j,k,r 
From Am386SX/SXL CPU Task to AM386SX/SXL CPU TSS via Task Gate g,j,k,r 
From Am386SX/SXL CPU Task to Virtual 8086 Mode via Task Gate Q,j,k,r 
From Virtual 8086 Mode to 80286 TSS via Task Gate g, j,k, r 
From Virtual 8086 Mode to Am386SX/SXL CPU TSS via Task Gate g,j,k,r 
From Virtual 8086 Mode to Privilege Level 0 via Trap Gate or Interrupt Gate g, I r 
g,J, K, fT 
BOUND 
Via Interrupt or Trap Gate to Same Privilege Level 
Via interrupt or Trap Gate to Different Privilege Level g, j,k, r 
From 80286 Task to 80286 TSS via Task Gate | | Dike 
From 80286 Task to Am386SX/SXL CPU TSS via Task Gate \ | 9, I r 
| 9,],K, 0 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 
| ClockCount_ | Notes 


Pade Protected a ‘ Protected 


Mode/ Virtual Mode/ | Virtual 
. Virtual Address | Virtual Address 
Instruction 8086 Mode Mode 8086 Mode Mode 


INTERRUPT INSTRUCTIONS (continued) 


BOUND (continued) 

From 80286 Task to Virtual 8086 Mode via Task Gate g,j,k,r 
From Am386SX/SXL CPU Task to 80286 TSS via Task Gate g,j,k,r 
From Am386SX/SXL CPU Task to Am386SX/SXL CPU TSS via Task Gate g,j,k,r 
From Am386SX/SXL CPU Task to Virtual 8086 Mode via Task Gate g,j,k,r 
From Virtual 8086 Mode to 80286 TSS via Task Gate g,|,k,r 
From Virtual 8086 Mode to Am386SX/SXL CPU TSS via Task Gate g,j,k,r 
From Virtual 8086 Mode to Privilege Level 0 via Trap Gate or Interrupt Gate g,j,k,r 


INTERRUPT RETURN | 
IRET =Interrupt Return 11001111 g,h,j, Kr 


Protected Mode Only (IRET) 
Via Interrupt or Trap Gate to Same Privilege Level (within Task) g,h,j,k,r 
Via Interrupt or Trap Gate to Different Privilege Level (within Task) g,h,j,k,r 
From 80286 Task to 80286 TSS h, j,k, r 
From 80286 Task to Am386SX/SXL CPU TSS h, j,k, 
From 80286 Task to Virtual 8086 Task h, j,k, 
From 80286 Task to Virtual 8086 Mode (within Task) | hej. ker 
From Am386SX/SXL CPU Task to Virtual 8086 TSS h, j,k, r 
From Am386SX/SXL CPU Task to 80286 TSS h, j,k, ¢ 
From Am386SX/SXL CPU Task to Am386SX/SXL CPU TSS h, j,k, r 
From Am386SX/SXL CPU Task to Virtual 8086 Mode (within Task) h, j,k, 6 


PROCESSOR CONTROL 


HLT =Halt 11110100 


MOV = Move To and From Control/Debug/Test Registers 


| | | | 
CRO/CR2/CR8 from Register 00001111,00100010]1 1 eee reg 10/4/5 10/4/5 | 


Register from CR38-—CRO 00001 1 11 1 1 eee reg | 
DR3—-DRO from Register 00001111400100011{1 1 eee reg 

DR7—-DR6 from Register 00001111 1 1 eee reg 

Register from DR7—DR6 COO O14 WA 1 1 eee reg | 
Register from DR3—DRO O000 4 4°I4 1 1 eee reg | 
TR7-TRé6 from Register oooot11tt 1 4 668 rag | 
Register from TR7—TR6 00001111 1 1 eee reg 


NOP = No Operation 10010000 





WAIT = Wait until BUSY pin is negated 10011011 


PROCESSOR EXTENSION INSTRUCTIONS 
See 387SX 


Processor Extension Escape 11011TTT}modELLL tm | Data sheet | 


TTT and LLL bits are op-code information for coprocessor. for clock 


PREFIX BYTES 


counts 


Address Size Prefix 01100111 4] 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 





Address 
Mode/ 
. | Virtual | 
| instruction Format | 8086 Mode | 


PREFIX BYTES (continued) 


LOCK = Bus Lock Prefix 


Operand Size Prefix 01100110 
Segment Override Prefix 


cs 00101110] 
DS 00111110 
ES 00100110 
FS 01100100 
01100101 
00110110] 


PROTECTION CONTROL 
ARPL= Adjust Requested Privilege Level 


From Register/Memory 01100011 | modreg r/m 20/21** 


LAR = Load Access Rights 


From Register/Memory 00001111/00000010 | modreg rim | 15/16* 


| LGDT = Load Global Descriptor 


Table Register }o0001111 400000001] mod 010 rm] 


| LIDT =Load Interrupt Descriptor 


Table Register jo0001111/00000001 {mod 011 Wm] 


| LLDT = Load Local Descriptor 


Table Register to Register/Memory 00001111{/00000000]| mod 010 tm 


LMSW = Load Machine Status Word 


From Register/Memory 00001111/00000001]| mod 110 tm 10/13* 


LSL = Load Segment Limit 


From Register/Memory 00001111{/00000011] modreg r/m 


Byte-Granular Limit 


Page-Granular Limit 20/21 g,h,j,p 


25/26* g,h,j,p 
LTR =Load Task Register 


From Register/Memory 00001111/00000000]{mod001 tm 23/27* 


SGDT = Store Global Descriptor 


Table Register 00001111{/00000001]mod000 t/m 


SIDT = Store Interrupt Descriptor 


Table Register 00001111/00000001] mod001 tm 





*IfCPLsIOPL ** If CPL>IOPL 
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Am386SX/SXL Instruction Set Clock Count Summary (continued) 
| ClockCount | Notes 


Instruction Format 


PROTECTION CONTROL (continued) 


| SLDT = Store Local Descriptor Table Register 


| To Register/Memory 00001111/00000000{fmod 000 tm 
SMSW =Store Machine Status Word 00001111{/00000001]mod100 t/m 


STR =Store Task Register 


To Register/Memory 00001111 mod 001 rm 
VERR = Verify Read Access 

Register/Memory 00001111 }oo000000) mod 10 0 r/m g,h,j,p 
VERW = Verify Write Access mod 101 f/m g,h,j,p 


“If CPL<IOPL ** If CPL>lOPL 





instruction Notes for Instruction Set Summary 
Notes a through c apply to Real Address Mode only: 
a. This is a Protected Mode instruction. Attempted execution in Real Mode will result in Exception 6 (invalid op-code). 


b. Exception 13 fault (general protection) will occur in Real Mode if an operand reference is made that partially or fully extends beyond the 
maximum CS, DS, ES, FS, or GS limit (FFFFH). Exception 12 fault (stack segment limit violation or not present) will occur in Real Mode if an 
operand reference is made that partially or fully extends beyond the maximum SS limit. 


c. This instruction may be executed in Real Mode. !In Real Mode, its purpose is primarily to initialize the CPU for Protected Mode. 
Notes d through g apply to Real Address Mode and Protected Virtual Address Mode: 


d. TheAm386SX/SXL CPU uses an early-out multiply algorithm. The actual number of clocks depends on the position of the most significant bit 
in the operand (multiplier). 


Clock counts given are minimum to maximum. To calculate actual clocks use the following formula: 
Actual Clock =if m < > 0, then max ([logz |ml], 3) +b clocks; 
=If m=0, then 3+b clocks 


In this formula, mis the multiplier, and 

b =9 for register to register; 

b = 12 for memory to register; 

b= 10 for register with immediate to register; 
b=11 for memory with immediate to register. 


e. An exception may occur, depending on the value of the operand. 

f. LOCKis automatically asserted, regardless of the presence or absence of the LOCK prefix. 
g. LOCKis asserted during descriptor table accesses. 

Notes h through r apply to Protected Virtual Address Mode only: 


h. Exception 13 fault will occur if the memory operand in CS, DS, ES, FS, or GS cannot be used due to either a segment limit violation or an 
access rights violation. If a stack limit is violated, an Exception 12 occurs. 


i. For segment load operations, the CPL, RPL, and DPL must agree with the privilege rules to avoid an Exception 13 fault. The segment's 
descriptor must indicate “present” or Exception 11 (CS, DS, ES, FS, GS not present). If the SS register is loaded and a stack segment not 
present is detected, an Exception 12 occurs. 


j. All segment descriptor accesses in the GDT or LDT made by this instruction will automatically assert LOCK to maintain descriptor integrity in 
multiprocessor systems. 


k. JUMP, CALL, INT, RET, and IRET instructions referring to another code segment will cause an Exception 13, if an applicable privilege rule is 
violated. 


An Exception 13 fault occurs if CPL is greater than 0 (0 is the most privileged level). 
. An Exception 13 fault occurs if CPL is greater than IOPL. 
The IF bit of the flag register is not updated if CPLis greater than IOPL. The IOPL and VM fields of the flag register are updated only if CPL =0. 
The PE bit of the MSW (CRO) cannot be reset by this instruction. Use MOV into CRO if desiring to reset the PE bit. 
Any violation of privilege rules as applied to the selector operand does not cause a protection exception; rather, the zero flag is cleared. 


If the coprocessor’s memory operand violates a segment limit or segment access rights, an Exception 13 fault will occur before the ESC 
instruction is executed. An Exception 12 fault will occur if the stack limit is violated by the operand’s starting address. 


r. The destination of a JMP, CALL, INT, RET, or IRET must be in the defined limit of a code segment or an Exception 13 fault will occur. 
s/t. The instruction will execute in s clocks if CPL < IOPL. If CPL>IOPL, the instruction will take t clock. 


8, OO. oS. ate 
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Instruction Encoding 
Overview 


All instruction encodings are subsets of the general 
instruction format shown in the Am386SX/SXL Instruc- 
tion Set Clock Count Summary (pages 217 thru 231). 
Instructions consist of one or two primary op-code 
bytes, possibly an address specifier consisting of the 
mod r/m byte and scaled index byte, a displacement if 
required, and an immediate data field if required. 


Within the primary op-code(s), smaller encoding fields 
may be defined. These fields vary according to the class 
of operation. The fields define such information as 
direction of the operation, size of the displacements, 
register encoding, or sign extension. 


Almost all instructions referring to an operand in 
memory have an addressing mode byte following the 
primary op-code byte(s). This byte (mod r/m) specifies 
the address mode to be used. Certain encodings of the 
mod r/m byte indicate a second addressing byte 
(scale-index-base byte) follows the mod r/m byte to fully 
specify the addressing mode. 


Addressing modes can include a _ displacement 
immediately following the mod r/m byte, or scaled index 
byte. Ifa displacement is present, the possible sizes are 
8, 16, or 32 bits. 


If the instruction specifies an immediate operand, the 
immediate operand follows any displacement bytes. 
The immediate operand, if specified, is always the last 
field of the instruction. 


Figure 57 illustrates several of the fields that can appear 
in an instruction, such as the mod field and the r/m field, 


but Figure 57 does not show all fields. Several smaller 
fields also appear in certain instructions, sometimes 
within the op-code bytes themselves. Table 22 is a 
complete list of all fields appearing in the Instruction Set. 
Further ahead, following Table 22, are detailed tables 
for each field. 


32-Bit Extensions of the Instruction Set 


With the Am386SX/SXL CPU, the 8086/80186/80286 
Instruction Set is extended in two orthogonal directions: 
32-bit forms of all 16-bit instructions are added to 
support the 32-bit data types; and, 32-bit addressing 
modes are made available for all instructions referenc- 
ing memory. This orthogonal instruction set extension is 
accomplished having a Default (D) bit in the code seg- 
ment descriptor, and by having 2 prefixes to the 
instruction set. 


Whether the instruction defaults to operations of 16 bits 
or 32 bits depends on the setting of the D bit in the code 
segment descriptor, which gives the default length 
(either 32 bits or 16 bits) for both operands and effective 
addresses, when executing that code segment. In the 
Real Address Mode or Virtual 8086 Mode, no code 
segment descriptors are used, but a D value of 0 is 
assumed internally by the Am386SX/SXL CPU when 
operating in those modes (for 16-bit default sizes 
compatible with the 8086/80186/80286). 


Two prefixes, the Operand Size Prefix and the Effec- 
tive Address Size Prefix, allow overriding individually 
the Default selection of operand size and effective ad- 
dress size. These prefixes may precede any op-code 
bytes and affect only the instruction they precede. If 
necessary, one or both of the prefixes may be placed 


Table 22. Fields within Instructions 


| Field Name Number of Bits _| 


Specifies if data is byte or full size (full size is either 16 or 32 bits) 


Specifies direction of data operation 


Specifies if an immediate data field must be sign-extended 


reg General Register Specifier 
mod r/m 


2 for mod; 3 for r/m 


ss 
index 
base 
sreg2 
sreg3 
tttn 





Address Mode Specifier (effective address can be a General Register) 

Scale Factor for Scaled Index Address Mode 

General Register to be used as Index Register 

General Register to be used as Base Register 

Segment Register Specifier for CS, SS, DS, and ES 

Segment Register Specifier for CS, SS, DS, ES, FS, and GS 

For Conditional Instructions, specifies a condition asserted or a condition negated 


Note: Table 21 shows encoding of individual instructions. 


TTTTTITTTITTITITTttTt t{mod TTT r/m d32|16| 8 | none datas2| 16 | 8 | none 


7 0 7 0765320,765 3 20 
a 
op-code mod r/m s-i-b r rr uha immediate 
(one or two bytes) byte byte isplacement ata 
(T represents an op-code bit) : (4, 2, 1 bytes, (4, 2, 1 bytes, 
register and address or none) or none) 
mode specifier 15022B-041 


232 


Figure 57. General Instruction Format 
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before the op-code bytes. The presence of the Operand 
Size Prefix and the Effective Address Prefix will toggle 
the operand size or the effective address size, 
respectively, to the value opposite from the Default 
setting. For example, if the default operand size is for 
32-bit data operations, then presence of the Operand 
Size Prefix toggles the instruction to 16-bit data 
operation. As another example, if the default effective 
address size is 16 bits, presence of the Effective 
Address Size prefix toggles the instruction to use 
32-bit effective address computations. 


These 32-bit extensions are available in all modes, 
including the Real Address Mode and the Virtual 8086 
Mode. In these modes the default is always 16 bits, so 
prefixes are needed to specify 32-bit operands or 
addresses. For instructions with more than one prefix, 
the order of prefixes is unimportant. 


Unless specified otherwise, instructions with 8-bit and 
16-bit operands do not affect the contents of the 
high-order of the extended registers. 


Encoding of Instruction Fields 


Within the instruction are several fields indicating 
register selection, addressing mode and so on. The 
exact encodings of these fields are defined immediately 
ahead. 


Encoding of Operand Length (w) Field 


For any given instruction performing a data operation, 
the instruction is executing as a 32-bit operation or a 
16-bit operation. Within the constraints of the operation 
size, the w field encodes the operand size as either one 
byte or the full operation size, as shown in the table 


below. 
During 16-Bit During 32-Bit 


ae Data Operations | Data Operations 
0 8 Bits 8 Bits 
| 16 Bits 32 Bits 


Encoding of the General Register (reg) Field 






Operand Size Operand Size 





The general register is specified by the reg field, which 
may appear in the primary op-code bytes, or as the reg 
field of the mod r/m byte, or as the r/m field of the mod 
r/m byte. 


Encoding of reg Field When w Field is not 
Present in Instruction 


Register Selected | Register Selected 
During 16-Bit During 32-Bit 
reg Field Data Operations | Data Operations 
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Encoding of reg Field When w Field is 
Present in Instruction 


Register Specified by reg Field 
During 16-Bit Data Operations 
Function of w Field 
| AL AX 







Register Specified by reg Field 
During 32-Bit Data Operations 


Function of w Field 
(when w = 0) (when w = 1) 





Encoding of the Segment Register (sreg) Field 


The sreg field in certain instructions is a 2-bit field, allow- 
ing one of the four 80286 segment registers to be 
specified. The sreg field in other instructions is a 3-bit 
field, allowing the Am3886SX/SXL CPU FS and GS 
segment registers to be specified. 


2-Bit sreg2 Field 
2-Bit sreg2 Field Segment Register Selected 
00 ES 


CS 
SS 
DS 





01 
10 
11 





3-Bit sreg3 Field 


3-Bit sreg3 Field Segment Register Selected 
000 ES 


do not use 
do not use 
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Encoding of Address Mode 


Except for special instructions, such as PUSH or POP, 
where the addressing mode is predetermined, the ad- 
dressing mode for the current instruction is specified by 
addressing bytes following the primary op-code. The 
primary addressing byte is the mod r/m byte, and a sec- 
ond byte of addressing information, the s-i-b (scale-in- 
dex-base) byte, can be specified. 


The s-i-b byte is specified when using 32-bit addressing 
mode, the mod r/m byte has r/m = 100, and mod = 00, 
01, or 10. When the s-i-b byte is present, the 32-bit ad- 
dressing mode is a function of the mod, ss, index, and 
base fields. 


The primary addressing byte, the mod r/m byte, 
also contains three bits (shown as TTT in Figure 57) 


sometimes used as an extension of the primary op- 
code. The three bits, however, may also be used as a 
register field (reg). 


When calculating an effective address, either 16-bit ad- 
dressing or 32-bit addressing is used. 16-bit addressing 
uses 16-bit address components to calculate the effec- 
tive address, while 32-bit addressing uses 32-bit ad- 
dress components to calculate the effective address. 
When 16-bit addressing is used, the mod r/m byte is in- 
terpreted as a 16-bit addressing mode specifier. When 
32-bit addressing is used, the mod r/m byte is inter- 
preted as a 32-bit addressing mode specifier. 


Tables on the following pages define all encodings of all 
16-bit addressing modes and 32-bit addressing modes. 


Encoding of 16-Bit Address Mode with mod r/m Byte 


DS:[BX + Sl] 
DS: [BX + Dl] 
SS: [BP + Sl] 
DS: [BP + Dl] 
DS:[S}j 
DS: [DI] 
DS:d16 
DS:[BX] 


DS:[BX + SI + d8] 
DS:[BX + DI + d8] 
SS;[BP + Sl + d8] 
SS:[BP + Di + d8] 
DS [SI + d8] 
DS{DI + d8] 
SS:[BP + d8] 
DS{BX + d8] 


DS:BX + SI + d16] 
DS:[BX + Dl + d16] 
SS:[BP + Sl + d16] 
SS:[BP + Si+d16] 
DS:[SI + d16] 
DS;[DI + d16] 
SS:[BP + d16] 
DS:[BX + d16] 


Register—See Below 
Register—See Below 
Register—See Below 
Register—See Below 
Register—See Below 
Register—See Below 
Register—See Below 
Register—See Below 








Register Specified by r/m 
During 16-Bit Data Operations 


Function of w Field 
modrim | (whenw=0) | (whenw=1) 








Register Specified by r/m 
During 32-Bit Data Operations | 
Function of w Field 
mod t/m stn w = 0) 
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Encoding of 32-Bit Address Mode with mod r/m Byte (no s-i-b byte present) 












DS:[EAX] 
DS[ECX] 
DS[EDX] 
DS:[EBX] 
s-i-b is present 
DS:d32 


DS{ESI] 
DSEDI] 


DS:[EAX + d8] 
DS:[ECX + d8] 
DS:[EDX + d8] 
DS:[EBX + d8] 
s-i-b is present 
SS:[EBP + d8] 
DS:[ESI + d8] 

DS:[EDI + d8] 


Register Specified by reg or r/m 
During 32-Bit Data Operations 
Function of w Field 
(whenw=0) | (whenw=1) _| 


Register Specified by reg or r/m 
During 16-Bit Data Operations 
Function of w Field 
| (whenw=0) | (when w= 1) 


DS:[EAX + d32] 
DS:[ECX + d32] 
DS:[EDX + d32] 
DS {EBX + d32] 
s-i-b is present 
SS:[EBP + d32] 
DS:[ESI + d32] 
DS:[EDI + d32] 


Register—See Below 
Register—See Below 
Register—See Below 
Register—See Below 
Register—See Below 
Register—See Below 
Register—See Below 
Register—See Below 
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a1 amp 
Encoding of 32-Bit Address Mode (mod r/m byte and s-i-b byte present): 







DS:[EAX + (scaled index)] 00 x1 
DS:[ECX + (scaled index)] 01 x2 
10 x4 


DS:[EDX + (scaled index)] 
DS:[EBX + (scaled index)] 
SS:[ESP + (scaled index)] 
DS:[d32 + (scaled index)] 
DS:[ESI + (scaled index)] 
DS:[EDI + (scaled index)] 


11 x8 


EAX 
ECX 
EDX 
EBX 
no index reg (see note) 
EBP 
ESI 
111 EDI 





DS:[EAX + (scaled index) + d8] 
DS:[ECX + (scaled index) + d8] 
DS:[EDX + (scaled index) + d8] 


DS:[EBX + (scaled index) + d8] 
SS:[ESP + (scaled index) + d8] 
SS:[EBP + (scaled index) + d8] 
DS:[ESI + (scaled index) + d8] | | 
DS:[EDI + (scaled index) + d8] Note: When index field is 100, indicating no index register, then ss 


field must equal 00. If index is 100 and ss does not equal 00, 
the effective address is undefined. 


DS:[EAX + (scaled index) + d32] 
DS:[ECX + (scaled index) + d32] 
DS:[EDX + (scaled index) + d32] 
DS:[EBX + (scaled index) + d32] 
SS:[ESP + (scaled index) + d32] 
SS:[EBP + (scaled index) + d32] 
DS:[ESI + (scaled index) + d32] 

DS:[EDI + (scaled index) + d32] 





Note: Mod field in mod r/m byte; ss, index, and base fields in s-i-b byte. 
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Encoding of Operation Direction (d) Field 


In many two-operand instructions, the d field is present 
to indicate which operand is considered the source and 
which is the destination. 


Sd Direction of Operation | 


Register/Memory < Register 
reg Field indicates Source Operand; ! 
mod r/m or mod ss index base indicates Destination | 


Operand. 


| Register = Register/Memory 


reg Field indicates Destination Operand; 
mod r/m or mod ss index base indicates Source 
Operand. 





Encoding of Sign-Extend (s) Field 


The s field occurs primarily to instructions with immedi- 
ate data fields. The s field has an effect only if the size of 
the immediate data is 8 bits and is being placed ina 
16-bit or 32-bit destination. 


: Effect on | Effect on 
| : Immediate Data8 | Immediate Data 16|32 | 
aa | 


Sign-Extended Data8 to Fill 
16-Bit or 32-Bit Destination 






Encoding of Conditional Test (tttn) Field 


For the conditional instructions (conditional jumps and 
set on condition), tttn is encoded with n indicating to 
use the condition (n = 0), or its negation (n = 1), and 
ttt giving the condition to test. 





AMD cl 
lcemeniel —Gendon Tin 


Overflow 
No Overflow 


| Below/Not Above or Equal 
| Not Below/Above or Equal 
Equal/Zero 
Not Equal/Not Zero 
| Below or Equal/Not Above 


| Not Below or Equal/Above 
| Sign 
| Not Sign 
Parity/Parity Even 
No Parity/Parity Odd 
Less Than/Not Greater or Equal 
Not Less Than/Greater or Equal 
Less Than or Equal/Not Greater Than 
Not Less Than or Equal/Greater Than 


Encoding of Control or Debug or Test Register (eee) 
Field 


For the loading and storing of the Control, Debug, and 
Test registers. 


When Interpreted as Control Register Field 


CRO 

5 : CR2 
011 —_CR3 
Do not use any other encoding _ 


When Interpreted as Debug Register Field 








Do n not use > any other encoding 
When pasate as Test Register Field 


eee Code Reg Name 





Do r not use any other encoding 
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PHYSICAL DIMENSIONS 


For reference only. All dimensions measured in inches unless otherwise noted. BSC is an ANSI standard for Basic 
Space Centering. 


PQB 100— Plastic Quad Flat Pack; Trimmed and Formed 
(all measurements are in inches) 





Side View 


15679G 
CF 43 
7/16/92 SG 
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PHYSICAL DIMENSIONS (continued) 


PQB 100— Plastic Quad Flat Pack with Molded Carrier Ring 
(Inner device measured in inches; outer ring measured in millimeters) 











45.87 
46.13 45.50 
41.37 45.90 
41.63 37.87 
35.15 38.13 
35.25 32.15 
0.897 32.25 
0.903 744 
0.752 
pla cia | 
Abts x eee Sees 
fire | | | : I iT | -6]\ 
le a 
as 
iil mM il 






















EE  ———— 


Le 





45.50 | 37.87 132.15 | 0.744 
45.90 | 38.13 /32.25 | 0.752 


| 
Ons 


| 


| 


| 


| 


| 


| 


a 


45.87 | 41.37 | 35.15 | 0.897 


46.13 | 41.63 | 35.25 | 0.903 


| 


| 





| 




















A 
PU LL 





TOP VIEW 025 NOM 






2.00} 4.80 
1.80 
SIDE VIEW 
15680D 
CB 51 
7/16/92 SG 
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